# Promtail configuration
# Aut-O — T-12 Monitoring Stack
# Collects Docker container logs and system logs, ships to Loki

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  # Docker container logs — reads JSON log files from Docker's log directory
  - job_name: docker
    static_configs:
      - targets:
          - localhost
        labels:
          job: docker
          __path__: /var/lib/docker/containers/**/*.log
    pipeline_stages:
      # Parse Docker JSON log format
      - docker: {}
      # Extract container name from the file path
      - regex:
          source: filename
          expression: "/var/lib/docker/containers/(?P<container_id>[a-f0-9]+)/"
      - labels:
          container_id:

  # System logs
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: syslog
          __path__: /var/log/syslog
      - targets:
          - localhost
        labels:
          job: authlog
          __path__: /var/log/auth.log

  # Application logs — add paths to your app's log files if not using Docker
  # - job_name: app
  #   static_configs:
  #     - targets:
  #         - localhost
  #       labels:
  #         job: app
  #         __path__: /var/log/app/*.log
  #   pipeline_stages:
  #     - json:
  #         expressions:
  #           level: level
  #           correlationId: correlationId
  #           service: service
  #           message: message
  #     - labels:
  #         level:
  #         service:
  #         correlationId:
