[jtslear]

Stacked on #106; the base is that branch and GitHub will retarget this to main once it merges.

Two changes to how Coder logs are processed in Alloy.

Parse every Coder component. The level / logger parsing now applies to workspace pods as well as coderd and provisioners, since workspace agents log in the same format. The component label from #106 decides which pods are parsed.

Keep only the message in the stored line. Today the stored line still begins with the timestamp, [level] and logger name, so Grafana shows the time and severity twice: once from Loki and once in the text. Once parsed, the timestamp is the entry's time and the level and logger are labels, so the line now holds only the message. Filter with labels ({component="coderd", level="error"}) instead of matching text like [error]. Lines already in Loki keep their old text and age out normally.

While in there, the regex is tightened so stripping can't mangle a message:

• The logger is optional. Root-logger lines such as Started HTTP listener at http://0.0.0.0:3000 previously matched [^:]+ and would have had everything up to http: taken as the logger; they now keep the whole message and get no logger label (an empty one is dropped).
• The regex matches across newlines, so multi-line entries (stack traces) are kept in full.
• Lines that don't match, such as other output in a workspace pod, are left untouched.

Checked by running the rendered loki.process "pod_logs" pipeline in Alloy v1.20.1 against sample CRI logs: a normal line, a root-logger line, a multi-line panic, [WARN] text in the message, a non-Coder line in a workspace pod, and a Coder-format line in a workspace pod. Each came out with the expected labels, timestamp and message. The rendered config also passes alloy fmt, and the chart lints and renders with each selector blanked.

🤖 Generated with Claude Code