Send output_fields to Loki

[Zalaxx]

Motivation
Currently, when using Loki to store events from falco sidekick, only the output string is sent (source code). It cause issue to properly parse the event, and is missing informations. Other destinations seems to support sending output_fields.

Feature
Add the ability to send output_fields instead of output to Loki, either by default or with an aditionnal configuration like send_json_output or something.

Alternatives
Improve the formatting of the logfmt output string, by quoting values containing a space.

Additional context
I would be happy to provide a pull request, I just need some guidance on how to integrate the change (retro-compatibility, configuration, defaults...)

[Issif]

Hi,

The output fields are not used as labels for the Loki log lines in purpose, it's to avoid to explode the cardinality as they might be numerous.

However, it's already possible to list the output fields you would like to have:

Setting	Env var	Default value	Description
loki.extralabels	LOKI_EXTRALABELS		comma separated list of fields to use as labels additionally to rule, source, priority, tags and custom_fields

For example:

loki:
  extralabels: "container.name, container.id"

Does it fit with your needs?

[Zalaxx]

Thank you for the quick answer,
What I want to do is not to modify the labels, but the content of the log entry sent to loki (the Values field in the source code).
The logs are not indexed as a separate stream (only labels are) but can still be parsed and extracted for further processing and filtering. So if the log was in JSON, we could just pop a | json after the stream selector and use the fields we want (doc).

[Issif]

Ok I see now what you meant. It's pretty easy add a new config option:

loki:
  format: text # format for the log entry: text, json (default: text)

[Issif]

By checking for your PR, I noticed some improvements to do for the Loki output, I included your request in the same PR: #1091

[Zalaxx]

That was fast, thank you very much! <3

[Issif]

I can't give you any ETA for the release. If it's urgent, you can still use the master branch like this (with an Helm deployment):

falcosidekick:
  image:
    tag: master
  config:
    extraEnv:
      - LOKI_FORMAT: json