0
Grafana Loki is an open source log aggregation system inspired by
Prometheus. While it is possible to use Loki with
Grafana Alloy, a simpler approach is to send logs directly using the
Loki HTTP API.
The following example modifies the ddos-protect application to use sFlow-RT's httpAsync() function to send events to Loki's HTTP API.
var lokiPort = getSystemProperty("ddos_protect.loki.port") || '3100';
var lokiPush = getSystemProperty("ddos_protect.loki.push") || '/loki/api/v1/push';
var lokiHost = getSystemProperty("ddos_protect.loki.host");
function sendEvent(action,attack,target,group,protocol) {
if(lokiHost) {
var url = 'http://'+lokiHost+':'+lokiPort+lokiPush;
lokiEvent = {
streams: [
{
stream: {
service_name: 'ddos-protect'
},
values: [[
Date.now()+'000000',
action+" "+attack+" "+target+" "+group+" "+protocol,
{
detected_level: action == 'release' ? 'INFO' : 'WARN',
action: action,
attack: attack,
ip: target,
group: group,
protocol: protocol
}
]]
}
]
};
httpAsync({
url: url,
headers: {'Content-Type':'application/json'},
operation: 'POST',
body: JSON.stringify(lokiEvent),
success: (response) => {
if (200 != response.status) {
logWarning("DDoS Loki status " + response.status);
}
},
error: (error) => {
logWarning("DDoS Loki error " + error);
}
});
}
if(syslogHosts.length === 0) return;
var msg = {app:'ddos-protect',action:action,attack:attack,ip:target,group:group,protocol:protocol};
syslogHosts.forEach(function(host) {
try {
syslog(host,syslogPort,syslogFacility,syslogSeverity,msg);
} catch(e) {
logWarning('DDoS cannot send syslog to ' + host);
}
});
}
Continue reading
