Transfering syslog-ng config from systemd to initd system - linux

Question

Our team have changed linux distro from arch to crux, and I have a problem moving the logging setup, which was done on the old distro. I think the issue is mainly with template-functions and rewrite rules in syslog-ng config:
template-function "node" "${.SDATA.NODE:-}";
template-function "host" "${.SDATA.HOST:-}";
template-function "login" "${.SDATA.LOGIN:-}";
template-function "type" "${.SDATA.TYPE:-}";
template-function "menu" "${.SDATA.MENU:-}";
template-function "action" "${.SDATA.ACTION:-}";
template-function "status" "${.SDATA.STATUS:-}";
template-function "unit" "${.SDATA._SYSTEMD_UNIT:-}";
template-function "priority" "${LEVEL_NUM:-}";
template-function "facility" "${FACILITY_NUM:-}";
template-function "hostname" "${HOST:-}";
template-function "program" "${PROGRAM:-}";
template-function "search" "${MESSAGE:-}";
template-function "address" "${FULLHOST_FROM:-}";
source s_local {
channel {
source {
#systemd-journal(prefix(".SDATA.journald."));
file("/var/log/messages");
internal();
};
rewrite { set("localhost" value("NODE")); };
junction {
channel {
parser { json-parser(prefix(".json.")); };
rewrite {
set("${.json.context.HOST}" value("HOST"));
set("${.json.context.LOGIN}" value("LOGIN"));
set("${.json.context.TYPE}" value("TYPE"));
set("${.json.context.MENU}" value("MENU"));
set("${.json.context.MSG.action}" value("ACTION"));
set("${.json.context.MSG.status}" value("STATUS"));
};
flags(final);
};
channel {
flags(final);
};
};
};
};
...
Promtail config:
server:
http_listen_address: localhost
grpc_listen_address: localhost
http_listen_port: 9080
grpc_listen_port: 0
positions:
filename: /var/lib/promtail/positions.yaml
clients:
- url: http://localhost:3100/loki/api/v1/push
scrape_configs:
- job_name: syslog
syslog:
listen_address: localhost:1514
label_structured_data: true
labels:
job: syslog
relabel_configs:
- source_labels:
- __syslog_message_hostname
target_label: host
- source_labels:
- __syslog_message_NODE
target_label: node
- source_labels:
- __syslog_message_HOST
target_label: host
- source_labels:
- __syslog_message_LOGIN
target_label: login
- source_labels:
- __syslog_message_TYPE
target_label: type
- source_labels:
- __syslog_message_MENU
target_label: menu
- source_labels:
- __syslog_message_ACTION
target_label: action
- source_labels:
- __syslog_message_STATUS
target_label: status
- source_labels:
- __syslog_message__SYSTEMD_UNIT
target_label: unit
- source_labels:
- __syslog_message_PRIORITY
target_label: priority
- source_labels:
- __syslog_message_SYSLOG_FACILITY
target_label: facility
- source_labels:
- __syslog_message_hostname
target_label: hostname
- source_labels:
- __syslog_message_app_name
target_label: program
Loki config:
auth_enabled: false
server:
http_listen_address: 0.0.0.0
grpc_listen_address: localhost
http_listen_port: 3100
ingester:
wal:
enabled: true
dir: /var/lib/loki/wal
lifecycler: { address: 127.0.0.1, ring: { kvstore: { store: inmemory }, replication_factor: 1 }, final_sleep: 0s }
chunk_idle_period: 1h
max_chunk_age: 1h
chunk_target_size: 1048576
chunk_retain_period: 30s
max_transfer_retries: 0
schema_config:
configs: [{ from: '2020-10-24', store: boltdb-shipper, object_store: filesystem, schema: v11, index: { prefix: index_, period: 24h } }]
storage_config:
boltdb_shipper: { active_index_directory: /var/lib/loki/boltdb-shipper-active, cache_location: /var/lib/loki/boltdb-shipper-cache, cache_ttl: 24h, shared_store: filesystem }
filesystem: { directory: /var/lib/loki/chunks }
compactor:
working_directory: /var/lib/loki/boltdb-shipper-compactor
shared_store: filesystem
limits_config:
reject_old_samples: true
reject_old_samples_max_age: 168h
chunk_store_config:
max_look_back_period: 30d
table_manager:
retention_deletes_enabled: true
retention_period: 30d
frontend:
address: 0.0.0.0
I have already modified the old configs by changing such lines
- source_labels:
- __syslog_message_sd_journald_HOST
# into
- source_labels:
- __syslog_message_HOST
And
template-function "login" "${.SDATA.journald.LOGIN:-}";
# into
template-function "login" "${.SDATA.LOGIN:-}";
Well, I guess I did something wrong, since it doesnt work as before :) I test it by querying /loki/api/v1/query?query={job="syslog"}.
I would appreciate if someone could decode this config to me, and explain what an I missing, and what should I check