如何使用Alloy为Loki日志添加AWS EC2相关标签？

# 发现本地Docker容器
discovery.docker "local" {
  host = "unix:///var/run/docker.sock"
}

# 处理Docker容器标签，提取container名称
discovery.relabel "docker" {
  targets = []
  
  rule {
      source_labels = ["__meta_docker_container_name"]
      regex = "/(.*)"
      target_label = "container"
  }
}

# 发现当前EC2实例（替换region为你的实例所在区域）
discovery.ec2 "local" {
  region = "us-east-1"
  refresh_interval = "5m"

  # 过滤仅发现当前运行Alloy的实例（可选，避免发现同区域其他实例）
  filter {
    name = "instance-id"
    values = [sys.exec("curl -s http://169.254.169.254/latest/meta-data/instance-id")]
  }
}

# 处理EC2元数据，提取需要的标签
discovery.relabel "ec2" {
  targets = discovery.ec2.local.targets

  rule {
    source_labels = ["__meta_ec2_instance_id"]
    target_label = "instance_id"
  }

  rule {
    source_labels = ["__meta_ec2_instance_type"]
    target_label = "instance_type"
  }

  rule {
    source_labels = ["__meta_ec2_availability_zone"]
    target_label = "availability_zone"
  }
}

# 合并Docker和EC2的targets，让容器日志带上EC2实例标签
discovery.merge "combined" {
  targets = [discovery.docker.local.targets, discovery.relabel.ec2.targets]
}

# 采集Docker日志，应用合并后的标签规则
loki.source.docker "local" {
  host = "unix:///var/run/docker.sock"
  targets = discovery.merge.combined.targets
  forward_to = [loki.write.grafana_cloud.receiver]
  relabel_rules = concat(discovery.relabel.docker.rules, discovery.relabel.ec2.rules)
}

# 发送日志到Loki
loki.write "grafana_cloud" {
  endpoint {
    url = "loki:3100/loki/api/v1/push"

    basic_auth {
      username = sys.env("LOKI_USER")
      password = sys.env("LOKI_TOKEN")
    }
  }
}

关键修改说明 #

• 添加discovery.ec2组件：用于获取EC2实例的元数据，需指定实例所在AWS区域；可选的filter规则确保仅发现当前运行Alloy的实例，避免无关实例干扰。
• 添加discovery.relabel.ec2：从EC2的元数据标签（前缀__meta_ec2_*）中提取需要的字段，转换为友好的标签名（如instance_id、instance_type）。
• 使用discovery.merge合并targets：将Docker容器的targets和EC2实例的targets合并，让每个容器日志的上下文带上EC2实例的标签信息。
• 合并relabel规则：通过concat函数把Docker和EC2的relabel规则合并，确保两种标签都能应用到日志上。

权限说明 #

运行Alloy的EC2实例需要具备ec2:DescribeInstances的IAM权限，否则discovery.ec2组件无法获取实例元数据。可给实例附加以下IAM策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*"
    }
  ]
}

备选方案（无需IAM权限） #

如果不想配置IAM权限，可直接从EC2元数据服务获取标签，添加到loki.write的静态标签中：

loki.write "grafana_cloud" {
  static_labels = {
    instance_id = sys.exec("curl -s http://169.254.169.254/latest/meta-data/instance-id"),
    instance_type = sys.exec("curl -s http://169.254.169.254/latest/meta-data/instance-type"),
    availability_zone = sys.exec("curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone")
  }
  # 其余配置不变
}

内容的提问来源于stack exchange，提问作者jamesrogers93