Grafana Alloy
The agent that reads log files on the Pi and ships them into Loki. It replaced the retired Promtail.
#What it is
Alloy is Grafana's collector: it gathers logs (and metrics and traces) and forwards them somewhere. Its config is built from components wired into a pipeline. For my needs that's three: find the files, tail them, send the lines to Loki.
Alloy is the successor to Promtail, which is retired. Plenty of older guides still use Promtail; for a new build, use Alloy.
#Why I use it
It's the "forwarder" in my home SIEM. It tails /var/log/pihole/pihole.log and OpenCanary's JSON log, tags each with a job label, and pushes them into Loki on localhost.
#Benefits
- Remembers its position in each file, so a restart doesn't resend or lose lines.
- One agent for everything if you later add metrics or other log sources.
- Readable config: each block says what it does.
#Gotchas I hit
- Permissions. Alloy runs as its own user, which can't read Pi-hole's logs by default.
sudo usermod -aG pihole,adm alloy, then restart Alloy, because group changes only apply to a freshly started process. - Confirm it's working by looking for
start tailing fileinjournalctl -u alloy, then asking Loki which jobs it has:curl -s http://127.0.0.1:3100/loki/api/v1/label/job/values.