From 7f664ff6141ed6622504604b25d1e00cde013c06 Mon Sep 17 00:00:00 2001
From: Jean-Marie Gervais <jean-marie.gervais@dgfip.finances.gouv.fr>
Date: Mon, 17 Nov 2025 15:28:33 +0100
Subject: [PATCH] fix(alloy): fix "observability" alloy pipeline

---
 tdp_vars_defaults/alloy/alloy_agent.yml       | 13 +++++++++++--
 tdp_vars_defaults/tdp-cluster/tdp-cluster.yml | 13 +------------
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/tdp_vars_defaults/alloy/alloy_agent.yml b/tdp_vars_defaults/alloy/alloy_agent.yml
index 50ebec2..cfff946 100644
--- a/tdp_vars_defaults/alloy/alloy_agent.yml
+++ b/tdp_vars_defaults/alloy/alloy_agent.yml
@@ -37,7 +37,7 @@ alloy_pipelines:
         firstline: "{{ alloy_date_regex }}"
     - regex:
         expression: "{{ alloy_log_analyser_regex }}"
-      template:
+    - template:
         source: "level"
         template: "{{ '{{ ToLower (regexReplaceAll \\\"(?i)warn.*\\\" .Value \\\"warning\\\")  }}' }}"
     - timestamp:
@@ -49,11 +49,20 @@ alloy_pipelines:
   observability:
     - logfmt:
         mapping:
-          datetime: "ts"
+          datetime: "t"     # grafana uses t=<datetime>
           level: ""
+    - logfmt:
+        mapping:
+          datetime: "time"  # node_exporter and prometheus use time=<datetime>
+    - logfmt:
+        mapping:
+          datetime: "ts"    # loki and alloy use ts=<datetime>
     - timestamp:
         source: "datetime"
         format: "RFC3339"
+    - template:
+        source: "level"
+        template: "{{ '{{ ToLower (regexReplaceAll \\\"(?i)warn.*\\\" .Value \\\"warning\\\")  }}' }}"
     - labels:
         values:
           level: ""
diff --git a/tdp_vars_defaults/tdp-cluster/tdp-cluster.yml b/tdp_vars_defaults/tdp-cluster/tdp-cluster.yml
index 9e7ad04..ce5a933 100644
--- a/tdp_vars_defaults/tdp-cluster/tdp-cluster.yml
+++ b/tdp_vars_defaults/tdp-cluster/tdp-cluster.yml
@@ -122,18 +122,7 @@ observability_tdp_targets:
       group: grafana
       jobs:
         - log_file: "{{ grafana_log_dir }}/{{ grafana_log_file }}"
-          alloy_pipeline:
-            - logfmt:
-                mapping:
-                  datetime: "t"
-                  level: ""
-            - timestamp:
-                source: "datetime"
-                format: "RFC3339"
-            - labels:
-                values:
-                  level: ""
-
+          alloy_pipeline: observability
   exporter:
     unix_group: "{{ node_exporter_group }}"
     node: