// =============================================================================
// Base Alloy pipeline — centralized log collection (DaemonSet)
//
// System logs: loki.source.journal -> loki.process -> loki.write
//
// Container stdout/stderr is intentionally NOT shipped from here. K8s events
// (operationally the headlines: scheduling, OOM, restarts) ship from the
// separate `alloy-events` Deployment (see helm/alloy-events-values.yaml).
// =============================================================================

// -----------------------------------------------------------------------------
// System logs pipeline (journal)
// -----------------------------------------------------------------------------

loki.source.journal "system" {
    path           = "/var/log/journal"
    format_as_json = true
    forward_to     = [loki.process.system_logs.receiver]

    relabel_rules = loki.relabel.journal_relabel.rules
}

// Filter journal to only the units we care about
loki.relabel "journal_relabel" {
    forward_to = []

    rule {
        source_labels = ["__journal__systemd_unit"]
        regex         = "kubelet.service|containerd.service|kernel|nvidia-fabricmanager.service|nvidia-persistenced.service"
        action        = "keep"
    }

    rule {
        source_labels = ["__journal__systemd_unit"]
        target_label  = "unit"
    }
}

// Process system log lines
loki.process "system_logs" {
    forward_to = [loki.write.grafana_cloud.receiver]

    stage.static_labels {
        values = {
            node = env("NODE_NAME"),
        }
    }

    // Extract syslog priority from journal PRIORITY field and map to
    // standard log levels (RFC 5424: 0-3=error, 4=warn, 5-6=info, 7=debug)
    stage.json {
        expressions = {
            priority = "PRIORITY",
        }
    }
    stage.replace {
        source     = "priority"
        expression = "^(0|1|2|3)$"
        replace    = "error"
    }
    stage.replace {
        source     = "priority"
        expression = "^4$"
        replace    = "warn"
    }
    stage.replace {
        source     = "priority"
        expression = "^(5|6)$"
        replace    = "info"
    }
    stage.replace {
        source     = "priority"
        expression = "^7$"
        replace    = "debug"
    }
    stage.labels {
        values = {
            level = "priority",
        }
    }
    // Drop debug-level journal entries (priority 7)
    stage.drop {
        source              = "level"
        expression          = "debug"
        drop_counter_reason = "journal_debug"
    }

    // Move node into structured metadata
    stage.structured_metadata {
        values = {
            node = "",
        }
    }

    stage.label_drop {
        values = ["node"]
    }
}

// -----------------------------------------------------------------------------
// Writer — Grafana Cloud Loki
// -----------------------------------------------------------------------------

loki.write "grafana_cloud" {
    endpoint {
        url = env("LOKI_URL")

        basic_auth {
            username = env("LOKI_USERNAME")
            password = env("LOKI_API_KEY")
        }

        // Explicit batch and retry tuning for Grafana Cloud
        batch_wait          = "3s"
        batch_size          = "2MiB"
        min_backoff_period  = "500ms"
        max_backoff_period  = "30s"
        max_backoff_retries = 10
    }

    external_labels = {
        cluster = env("CLUSTER_NAME"),
    }
}
