otel: map journald PRIORITY onto a severity at every journald receiver
Records reached VictoriaLogs carrying the journal's raw PRIORITY and severity_text "Unspecified" — every line in the store, at every tier, with no level a query or a dashboard could read. VictoriaLogs has no ingest parameter naming a level field; it auto-detects one by field name, so the mapping has to happen in the collector. A stanza severity_parser on each journald receiver, from one shared file rather than a copy per tier: the two receivers are unrelated config (a fixed stanza in the agent container, a parameterised block inside the swarm-otel container) and a drifted copy fails silently — every line still arrives, labelled as the wrong thing. Two details that are easy to get wrong and quiet when wrong. PRIORITY counts down in urgency where the OTEL severity counts up, so the table is written as a table. And overwrite_text is required: without it the parser sets the severity number and leaves the text as the raw digit, so severity_text arrives as the literal "6" — populated, and not a level anything renders.
This commit is contained in:
parent
cc1f2d2594
commit
72a375b0db
3 changed files with 85 additions and 0 deletions
|
|
@ -265,6 +265,14 @@ in
|
|||
# and what the harness spawns, so there is no foreign traffic to
|
||||
# filter out and an allowlist would only be a list to forget to
|
||||
# update.
|
||||
|
||||
# journald's PRIORITY carries the level every line already has;
|
||||
# without this the record reaches VictoriaLogs with
|
||||
# `severity_text: Unspecified` and the store cannot tell an error
|
||||
# from a debug line. The table — and the inverted direction that
|
||||
# makes it worth a file of its own — lives in
|
||||
# ../journald-severity.nix, shared with the swarm tier's receiver.
|
||||
operators = import ../journald-severity.nix;
|
||||
};
|
||||
|
||||
# Identity the hop above cannot supply. A host-side reader can say
|
||||
|
|
|
|||
Loading…
Reference in a new issue