docker: replace Alloy by Vector for parsing logs

Alloy does not allow to turn the parsed metadata into actual metadata,
without enumerating each of them. Also, Vector is far more versatile.
And you can put unittests!

Also, parse more logs. Everything should be there, except ClickHouse.

Fix #1907

Author: vincentbernat

.github/workflows/ci.yml

@@ -56,6 +56,8 @@ jobs:
         run: make test-race
       - name: JS tests
         run: make test-js
+      - name: Vector tests
+        run: docker compose -f docker/docker-compose-dev.yml run --quiet --rm vector test
       - name: Run coverage tests
         run: make test-coverage
       - name: Upload coverage results

docker/alloy/config.alloy

@@ -1,199 +1,3 @@
-loki.write "default" {
-  endpoint {
-    url = "http://loki:3100/loki/loki/api/v1/push"
-  }
-}
-
-discovery.relabel "loki" {
-  targets = discovery.docker.docker.targets
-  rule {
-    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
-    regex         = `(.+)(?:-\d+)?`
-    target_label  = "service_name"
-  }
-  rule {
-    source_labels = ["__address__"]
-    regex         = `(.+):\d+`
-    target_label  = "instance"
-  }
-}
-
-discovery.relabel "akvorado" {
-  targets = discovery.relabel.loki.output
-  rule {
-    source_labels = ["service_name"]
-    regex         = "akvorado-.*"
-    action        = "keep"
-  }
-}
-loki.source.docker "akvorado" {
-  host          = "unix:///var/run/docker.sock"
-  targets       = discovery.relabel.akvorado.output
-  forward_to    = [loki.process.akvorado.receiver]
-}
-loki.process "akvorado" {
-  forward_to = [loki.write.default.receiver]
-  stage.json {
-    expressions = {
-      level   = "level",
-      time    = "time",
-      caller  = "caller",
-      error   = "error",
-      module  = "module",
-      message = "message",
-    }
-  }
-  stage.labels {
-    values = {
-      level  = "",
-      module = "",
-    }
-  }
-  stage.structured_metadata {
-    values = {
-      caller = "",
-      error  = "",
-    }
-  }
-  stage.timestamp {
-    source = "time"
-    format = "RFC3339"
-  }
-  stage.output {
-    source = "message"
-  }
-}
-
-discovery.relabel "kafka" {
-  targets = discovery.relabel.loki.output
-  rule {
-    source_labels = ["service_name"]
-    regex         = "kafka"
-    action        = "keep"
-  }
-}
-loki.source.docker "kafka" {
-  host          = "unix:///var/run/docker.sock"
-  targets       = discovery.relabel.kafka.output
-  forward_to    = [loki.process.kafka.receiver]
-}
-loki.process "kafka" {
-  forward_to = [loki.write.default.receiver]
-  stage.multiline {
-    firstline     = `^\[\d{4}-\d{2}-\d{2} `
-    max_wait_time = "3s"
-    max_lines     = 1000
-  }
-  stage.regex {
-    expression = `^\[(?P<timestamp>[^\]]+)\]\s+(?P<level>\w+)\s+(?P<message>(?s:.*))$`
-  }
-  stage.timestamp {
-    source = "timestamp"
-    format = "2006-01-02 15:04:05,000"
-  }
-  stage.labels {
-    values = {
-      level = "",
-    }
-  }
-  stage.output {
-    source = "message"
-  }
-}
-
-discovery.relabel "redis" {
-  targets = discovery.relabel.loki.output
-  rule {
-    source_labels = ["service_name"]
-    regex         = "redis"
-    action        = "keep"
-  }
-}
-loki.source.docker "redis" {
-  host          = "unix:///var/run/docker.sock"
-  targets       = discovery.relabel.redis.output
-  forward_to    = [loki.process.redis.receiver]
-}
-loki.process "redis" {
-  forward_to = [loki.write.default.receiver]
-  // 1:C 28 Aug 2025 04:08:22.843 # Warning: no config file specified
-  stage.regex {
-    expression = `^(?P<pid>\d+):(?P<role>[XCSM])\s+(?P<timestamp>\d+\s+\w+\s+\d{4}\s+\d{2}:\d{2}:\d{2}\.\d{3})\s+(?P<level>[*#.-])\s+(?P<message>.*)$`
-  }
-  stage.template {
-    source   = "role_name"
-    template = `{{ if eq .role "X" }}sentinel{{ else if eq .role "C" }}RDB{{ else if eq .role "S" }}slave{{ else if eq .role "M" }}master{{ end }}`
-  }
-  stage.template {
-    source   = "level_name"
-    template = `{{ if eq .level "." }}debug{{ else if eq .level "-" }}info{{ else if eq .level "*" }}notice{{ else if eq .level "#" }}warning{{ end }}`
-  }
-  stage.labels {
-    values = {
-      level = "level_name",
-      role  = "role_name",
-    }
-  }
-  stage.timestamp {
-    source = "timestamp"
-    format = "2 Jan 2006 15:04:05.000"
-  }
-  stage.output {
-    source = "message"
-  }
-}
-
-discovery.relabel "alloy" {
-  targets = discovery.relabel.loki.output
-  rule {
-    source_labels = ["service_name"]
-    regex         = "alloy"
-    action        = "keep"
-  }
-}
-loki.source.docker "alloy" {
-  host          = "unix:///var/run/docker.sock"
-  targets       = discovery.relabel.alloy.output
-  forward_to    = [loki.process.alloy.receiver]
-}
-loki.process "alloy" {
-  forward_to = [loki.write.default.receiver]
-  // ts=2025-08-28T09:30:45.497277819Z level=info msg="Scraped metadata watcher stopped" component_path=/ component_id=prometheus.remote_write.default subcomponent=rw remote_name=0ffafb url=http://prometheus:9090/prometheus/api/v1/write
-  stage.logfmt {
-    mapping = {
-      ts             = "",
-      level          = "",
-      msg            = "",
-      err            = "",
-      node           = "",
-      component_path = "",
-      component_id   = "",
-    }
-  }
-  stage.labels {
-    values = {
-      level = "",
-    }
-  }
-  stage.structured_metadata {
-    values = {
-      node           = "",
-      component_path = "",
-      component_id   = "",
-    }
-  }
-  stage.template {
-    source   = "message"
-    template = `{{ .msg }}{{ if .err }}: {{ .err }}{{ end }}`
-  }
-  stage.timestamp {
-    source = "ts"
-    format = "RFC3339"
-  }
-  stage.output {
-    source = "message"
-  }
-}
 
 discovery.relabel "lokilogs" {
   targets = discovery.relabel.loki.output

docker/alloy/loki.alloy

@@ -1,3 +1,12 @@
+discovery.docker "docker" {
+  host             = "unix:///var/run/docker.sock"
+  refresh_interval = "30s"
+  filter {
+    name   = "label"
+    values = ["com.docker.compose.project=akvorado"]
+  }
+}
+
 prometheus.remote_write "default" {
   endpoint {
     url = "http://prometheus:9090/prometheus/api/v1/write"

docker/alloy/prometheus.alloy renamed to docker/config.alloy

@@ -182,3 +182,16 @@ services:
     ports:
       - 127.0.0.1:57400:57400/tcp
       - 127.0.0.1:57401:22/tcp
+
+  vector:
+    extends:
+      file: versions.yml
+      service: vector
+    restart: "no"
+    profiles: [manual]
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./vector.yaml:/etc/vector/vector.yaml:ro
+      - ./vector.tests.yaml:/etc/vector/vector.tests.yaml:ro
+    environment:
+      VECTOR_CONFIG_DIR: /etc/vector

docker/docker-compose-alloy.yml

@@ -7,12 +7,10 @@ services:
       file: versions.yml
       service: grafana
     environment:
-      GF_INSTALL_PLUGINS: marcusolsson-json-datasource 1.3.8
       GF_SERVER_ROOT_URL: /grafana
       GF_SERVER_SERVE_FROM_SUB_PATH: "true"
     depends_on:
       - prometheus
-      - akvorado-console
     restart: unless-stopped
     volumes:
       - akvorado-grafana:/var/lib/grafana

docker/docker-compose-dev.yml

@@ -10,7 +10,7 @@ services:
     restart: unless-stopped
     volumes:
       - akvorado-loki:/loki
-      - ./loki.yaml:/etc/loki/local-config.yaml
+      - ./loki.yaml:/etc/loki/local-config.yaml:ro
     expose:
       - 3100/tcp
     labels:
@@ -19,11 +19,24 @@ services:
       - traefik.http.routers.loki.entrypoints=private
       - metrics.port=3100
 
-  alloy:
+  vector:
     extends:
-      file: docker-compose-alloy.yml
-      service: alloy
+      file: versions.yml
+      service: vector
+    restart: unless-stopped
+    user: root                  # for access to /var/run/docker.sock
     volumes:
-      - ./alloy/loki.alloy:/etc/alloy/loki.alloy
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./vector.yaml:/etc/vector/vector.yaml:ro
     depends_on:
       - loki
+    healthcheck:
+      interval: 20s
+      test: ["CMD",
+             "wget", "-T", "1", "--spider", "--url=http://127.0.0.1:8686/health"]
+    expose:
+      - 9598 # metrics
+    environment:
+      VECTOR_CONFIG_DIR: /etc/vector
+    labels:
+      - metrics.port=9598

docker/docker-compose-grafana.yml

@@ -35,15 +35,33 @@ services:
   # Fetch metrics
   alloy:
     extends:
-      file: docker-compose-alloy.yml
+      file: versions.yml
       service: alloy
+    restart: unless-stopped
+    user: root                  # for access to /var/run/docker.sock
     volumes:
-      - ./alloy/prometheus.alloy:/etc/alloy/prometheus.alloy
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./config.alloy:/etc/alloy/config.alloy
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    expose:
+      - 12345
+    command:
+      - run
+      - /etc/alloy
+      - --storage.path=/var/lib/alloy/data
+      - --server.http.listen-addr=0.0.0.0:12345
+      - --server.http.ui-path-prefix=/alloy
     depends_on:
       prometheus:
         condition: service_healthy
       kafka:
         condition: service_healthy
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.alloy.rule=PathPrefix(`/alloy`)
+      - traefik.http.routers.alloy.entrypoints=private
+      - metrics.port=12345
 
   # Node exporter for host metrics
   node-exporter: