Search code examples
grafanasystemdgrafana-lokipromtaillogql

How to extract systemd unit/service name from journal logs in Grafana?

I'm visualizing my systemd journal logs in Grafana, which I send using Promtail and store in Loki. I'd like to be able to see the systemd unit or service name that has generated each log entry in Grafana. Here's my current scrape configuration for Promtail:

scrape_configs:
  - job_name: journal
    journal:
      max_age: 12h
      labels:
        job: systemd-journal
        hostname: ''
    relabel_configs:
      - source_labels: ["_journal_systemd_unit"]
        target_label: "unit"

When I run the query `{job="systemd-journal"} |= `` in Grafana, a typical log entry looks like this: [output] As can be observed, the systemd unit or service name isn't visible anywhere in the log details.

What I've Tried:

I've attempted to use the relabel_configs to get the _journal_systemd_unit into a label named "unit". However, I can't seem to see this "unit" in Grafana's displayed log details.

Expected Outcome:

I'd like to see which service or systemd unit has generated the log, e.g., "systemd" or "mrs-driver-layer.sh", directly in the log details in Grafana.

Any assistance or pointers on how to achieve this would be much appreciated!

Solution

  • As @markalex suggested the syntax was wrong. It works now with two underscores