Promtail配置过滤掉日志行

Question

我已经阅读了promtail和doing pipeline的文档，我无法对其进行正面或反面分析。我只想删除源自Uptimerobot软件的日志行，我们使用这些软件来确定我们的网站是否已打开。

Promtail文档：https://grafana.com/docs/loki/latest/clients/promtail/pipelines/

日志采用json格式：

{ "time":"[17/Feb/2022:02:20:00 +0000]", "remoteIP":"172.18.0.4", "host":"api.mysite.tld", "request":"/v1/byUserId", "query":"", "method":"POST", "status":"200", "userAgent":"Mozilla/5.0+(compatible; UptimeRobot/2.0; http://www.uptimerobot.com/)", "referer":"https://api.mysite.tld/v1/byUserId" }

promtail配置

server:
http_listen_port: 9080
grpc_listen_port: 0
positions:
filename: /tmp/positions.yaml
clients:
- url: http://loki:3100/loki/api/v1/push
scrape_configs:
- job_name: apache_access
static_configs:
- targets:
- localhost
labels:
job: apache_access
__path__: /var/log/apache/site.access.log
pipeline_stages:
- json:
expressions:
userAgent: userAgent
- drop:
source: "userAgent"
regex: ".*uptimerobot.*"
- job_name: apache_error
static_configs:
- targets:
- localhost
labels:
job: apache_error
__path__: /var/log/apache/site.error.log

上面的配置会删除访问作业中的所有行。

我如何修改它以在userAgent中只删除UptimeRobot的行？

编辑

以下是提示日志：

level=info ts=2022-02-23T14:26:43.416816223Z caller=server.go:260 http=[::]:9080 grpc=[::]:46085 msg="server listening on addresses"
level=info ts=2022-02-23T14:26:43.417247269Z caller=main.go:119 msg="Starting Promtail" version="(version=2.4.1, branch=HEAD, revision=f61a4d261)"
level=info ts=2022-02-23T14:26:48.417542454Z caller=filetargetmanager.go:255 msg="Adding target" key="/var/log/apache/site.access.log:{job="apache_access"}"
level=info ts=2022-02-23T14:26:48.417721078Z caller=filetargetmanager.go:255 msg="Adding target" key="/var/log/apache/site.error.log:{job="apache_error"}"
ts=2022-02-23T14:26:48.417916312Z caller=log.go:168 level=info msg="Seeked /var/log/apache/site.access.log - &{Offset:0 Whence:0}"
level=info ts=2022-02-23T14:26:48.417970347Z caller=tailer.go:126 component=tailer msg="tail routine: started" path=/var/log/apache/site.access.log
ts=2022-02-23T14:26:48.419048351Z caller=log.go:168 level=info msg="Seeked /var/log/apache/site.error.log - &{Offset:0 Whence:0}"
level=info ts=2022-02-23T14:26:48.419071953Z caller=tailer.go:126 component=tailer msg="tail routine: started" path=/var/log/apache/site.error.log

已编辑以包含建议的配置更改。

Answer 1

尝试将pipeline_stages更改为：

pipeline_stages:
- json:
expressions:
userAgent: userAgent
- drop:
source: "userAgent"
regex: ".*uptimerobot.*"