server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  # Docker container logs
  - job_name: docker
    docker_sd_configs:
      - host: unix:///var/run/docker.sock
        refresh_interval: 5s
    relabel_configs:
      # Only process CFN-related containers
      - source_labels: ['__meta_docker_container_name']
        regex: '/cfn-.*'
        action: keep
      # Extract team label
      - source_labels: ['__meta_docker_container_name']
        regex: '/cfn-([^-]+)-.*'
        target_label: 'team'
      # Extract agent type
      - source_labels: ['__meta_docker_container_name']
        regex: '/cfn-[^-]+-([^-]+)-.*'
        target_label: 'agent_type'
      # Extract agent ID
      - source_labels: ['__meta_docker_container_name']
        regex: '/cfn-[^-]+-[^-]+-(.+)'
        target_label: 'agent_id'
      # Add container name
      - source_labels: ['__meta_docker_container_name']
        target_label: 'container_name'
      # Add container ID
      - source_labels: ['__meta_docker_container_id']
        target_label: 'container_id'
    pipeline_stages:
      # Parse JSON logs
      - json:
          expressions:
            timestamp: timestamp
            level: level
            message: message
            correlationId: correlationId
            context: context
            error: error
      # Extract timestamp
      - timestamp:
          source: timestamp
          format: RFC3339Nano
      # Add labels from JSON
      - labels:
          level:
          correlationId:
      # Template output
      - output:
          source: message

  # System logs
  - job_name: system
    static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__: /var/log/*log