Logs Relabel Rules

Logs don’t use the ingester relabel rules described in How Relabel Rules Work. The ingester has no relabelConfigs key for logs. Instead, logs are relabeled by the relabel function in the logs-parser pipeline, which you configure under logs-parser.kf_parsing_config in your Helm values. The full reference is in Log Parsing Configuration: Relabel.

How log relabel rules differ

Metrics, traces, events, and RUM Logs

Where rules are configured

ingester.config.<stream>.relabelConfigs

A relabel step in logs-parser.kf_parsing_config.config

Format

Prometheus relabel_config

The logs-parser’s own args list, loosely based on Prometheus relabeling

Actions

See How Relabel Rules Work

replace, drop, keep, lowercase, uppercase, label_map, label_keep, label_drop, and facet_to_label_map. See Actions.

Assigning a retention policy

The retention action

Set the reserved __kf_retention label to the policy name

Log relabel rules can match on labels (prefixed # or bare) and on facets (prefixed @). relabel always runs before facets are extracted, so it can’t see a facet that grammar (parser) or JSON auto-parsing produces. To act on an extracted facet, use transform instead. See Relabel, Transform priority order.

Common tasks

Each of these is configured in Log Parsing:

  • Add or rewrite a label: use the replace action. See Actions.

  • Drop log lines: use the drop or keep action. See Actions.

  • Remove or rename labels: use the label_drop, label_keep, or label_map action. See Actions.

  • Promote a facet to a label: use the facet_to_label_map action in a transform step for facets extracted by parsing. See Transform and fingerprinting.

  • Assign logs to a retention policy: set __kf_retention. See Logs Stream.

  • Apply a rule only to some logs: add conditions to the relabel step. See Functions and conditions.

Next steps