You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`source`|`string`| Name of the field in the extracted data to parse. |`message`| no |
1702
+
|`drop_invalid_labels`|`bool`| Whether to drop fields that aren't valid label names. |`false`| no |
1703
+
|`overwrite_existing`|`bool`| Whether to overwrite existing extracted data fields. |`false`| no |
1704
+
1705
+
When `overwrite_existing` is set to `true`, the stage overwrites existing extracted data fields with the same name.
1706
+
If set to `false`, the `_extracted` suffix is appended to an existing field name.
1707
+
1708
+
When `drop_invalid_labels` is set to `true`, the stage drops fields that aren't valid label names.
1709
+
If set to `false`, the stage automatically converts them into valid labels, replacing invalid characters with underscores.
1710
+
1711
+
The `windowsevent` stage expects the message to be structured in sections that are split by empty lines.
1712
+
1713
+
The first section of the input is treated as a whole block and stored in the extracted map with the key `Description`.
1714
+
1715
+
Sections following the Description are expected to contain key-value pairs in the format key:value.
1716
+
1717
+
If the first line of a section has no value, for example "Subject:", the key acts as a prefix for subsequent keys in the same section.
1718
+
1719
+
If a line within a section doesn't include the `:` symbol, it's considered part of the previous entry's value.
1720
+
The line is appended to the previous value, separated by a comma.
1721
+
1722
+
Lines in a section without a preceding valid entry (key-value pair) are ignored and discarded.
1723
+
1724
+
#### Example with `loki.source.windowsevent`
1725
+
1726
+
```alloy
1727
+
loki.source.windowsevent "security" {
1728
+
eventlog_name = "Security"
1729
+
forward_to = [loki.process.default.receiver]
1730
+
}
1731
+
loki.process "default" {
1732
+
forward_to = [loki.write.default.receiver]
1733
+
stage.json {
1734
+
expressions = {
1735
+
message = "",
1736
+
Overwritten = "",
1737
+
}
1738
+
}
1739
+
stage.windowsevent {
1740
+
source = "message"
1741
+
overwrite_existing = true
1742
+
}
1743
+
stage.labels {
1744
+
values = {
1745
+
Description = "",
1746
+
Subject_SecurityID = "",
1747
+
ReadOP = "Subject_ReadOperation",
1748
+
}
1749
+
}
1750
+
}
1751
+
```
1752
+
1753
+
The `loki.source.windowsevent` component forwards Windows security events to the `loki.process` component.
1754
+
1755
+
Given the following event:
1756
+
1757
+
```text
1758
+
{"event_id": 1, "Overwritten": "old", "message": ""Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-1-1\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0xAAA\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege""}
1759
+
```
1760
+
1761
+
The `json` stage would create the following key-value pairs in the set of extracted data:
1762
+
1763
+
-`message`: `"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-1-1\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0xAAA\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege"`
1764
+
-`Overwritten`: `old`
1765
+
1766
+
The `windowsevent` stage parses the value of `message` from the extracted data and appends or overwrites the following key-value pairs to the set of extracted data:
1767
+
1768
+
*`Description`: "Special privileges assigned to new logon.",
Finally the `labels` stage uses the extracted values `Description`, `Subject_SecurityID` and `Subject_ReadOperation` to add them as labels of the log entry before forwarding it to a `loki.write` component.
1776
+
1691
1777
## Exported fields
1692
1778
1693
1779
The following fields are exported and can be referenced by other components:
0 commit comments