Unable to drop INFO and DEBUG logs in Promtail configuration

[akramsadab]

Hello,

I'm trying to configure Promtail to drop logs with levels DEBUG, debug, INFO, info, trace, and TRACE. I've managed to successfully drop logs with levels trace, TRACE, debug, and info, but I'm still seeing logs with levels DEBUG and INFO.

My goal is to optimize the logs to minimize the cost of the S3 buckets which are storing the logs, as the costs are skyrocketing.

Here's my current configuration:

• job_name: system static_configs:
  • targets:
    • localhost labels: job: varlogs path: /var/log/*log pipeline_stages:
  • match: selector: '{job="varlogs"}' stages:
    • regex: expression: '^(?P\w{3} \d{1,2} \d{2}:\d{2}:\d{2}) (?P.*)$'
    • timestamp: source: timestamp format: Jan 2 15:04:05
    • regex: expression: '.\b(?P(debug|DEBUG|trace|TRACE|info|INFO))\b.' source: log
    • labels: level: ''
    • drop: source: level expression: '(debug|DEBUG|trace|TRACE|info|INFO)' I've tried multiple different alternatives, but none of them seem to work. I'm still seeing INFO and DEBUG logs.

Could anyone please help me understand what I'm doing wrong and how I can correctly configure Promtail to drop these logs?

Thank you in advance for your help.

[akramsadab]

Please help team

[jwillmer]

I have the same problem. This is my config - I also did a couple of iterations but it did not work:

scrape_configs:

  - job_name: docker-containers

    docker_sd_configs:
      - host: unix:///run/docker.sock
        refresh_interval: 15s

    relabel_configs:

        # log level from labels
      - source_labels: [__meta_docker_container_label_level]
        target_label: level

        # drop all other Docker internal labels
      - action: labeldrop
        regex: '__meta_docker_.*'

    pipeline_stages:
      - docker: {}
      - drop:
          # Drop logs where the level is info, debug, or trace
          source:     ["level"]
          expression:  '(?i)(info|debug|trace)'