1 files changed, 57 insertions, 5 deletions
diff --git a/modules/nixos/promtail.nix b/modules/nixos/promtail.nix
index 552df82..c038d7b 100644
--- a/modules/nixos/promtail.nix
+++ b/modules/nixos/promtail.nix
@@ -34,17 +34,69 @@ in {
           log_level = "warn";
         };
 
-        clients = [{url = "${cfg.loki.url}/loki/api/v1/push";}];
+        clients = [
+          {
+            url = "${cfg.loki.url}/loki/api/v1/push";
+            external_labels.host_id = config.networking.hostId;
+          }
+        ];
 
         positions.filename = "/tmp/positions.yaml";
 
         scrape_configs = [
           {
             job_name = "journal";
-            journal = {
-              max_age = "24h";
-              labels.job = "systemd-journal";
-            };
+            journal.max_age = "24h";
+            relabel_configs =
+              map (n: let
+                label = toLower n;
+              in {
+                source_labels = ["__journal_${label}"];
+                target_label =
+                  if hasPrefix "_" label
+                  then substring 1 (stringLength label - 1) label
+                  else label;
+              }) [
+                # Derived from systemd.journal fields[1][2].
+                #
+                # [1]: https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
+                # [2]: https://github.com/coreos/go-systemd/blob/main/sdjournal/journal.go#L335
+
+                "MESSAGE"
+                "MESSAGE_ID"
+                "PRIORITY"
+                # "CODE_FILE"
+                # "CODE_LINE"
+                # "CODE_FUNC"
+                "ERRNO"
+                "SYSLOG_FACILITY"
+                "SYSLOG_IDENTIFIER"
+                "SYSLOG_PID"
+                "_PID"
+                "_UID"
+                "_GID"
+                # "_COMM"
+                # "_EXE"
+                "_CMDLINE"
+                # "_CAP_EFFECTIVE"
+                # "_AUDIT_SESSION"
+                # "_AUDIT_LOGINUID"
+                # "_SYSTEMD_CGROUP"
+                # "_SYSTEMD_SESSION"
+                "_SYSTEMD_UNIT"
+                "_SYSTEMD_USER_UNIT"
+                # "_SYSTEMD_OWNER_UID"
+                # "_SYSTEMD_SLICE"
+                # "_SELINUX_CONTEXT"
+                # "_SOURCE_REALTIME_TIMESTAMP"
+                "_BOOT_ID"
+                "_MACHINE_ID"
+                "_HOSTNAME"
+                "_TRANSPORT"
+                # "__CURSOR"
+                # "__REALTIME_TIMESTAMP"
+                # "__MONOTONIC_TIMESTAMP"
+              ];
           }
         ];
       };