Promtail - Pipeline stage with Regex is not parsing the log line and creating labels

  • What Grafana version and what operating system are you using?
    Grafana V9.3.6, OS Red Hat Ent Linux
    Promtail Version v2.8.2

  • What are you trying to achieve?
    Application is hosted on windows server. I am using Promtail to harvest the logs and push the data to Loki. Using Grafana query Loki to build dashboards.

  • How are you trying to achieve it?
    Promtail is installed as a service on the application servers. Its configured to read the logs from different directories and push it to Loki.

  • What happened?
    I am using pipeline stages to extract labels from each log line. But the regex is always not working. I tried all combinations, but I am not able to see the labels in Grafana. Only the static labels are available. Attached are the sample log lines and confing info from Promtail

Log Lines Example:
[Test Message 1.1] [ 32] [Second Message 1.2] [Third Message 1.3] - [Hi Everyone. I am here]
[Test Message 2.1] [ 51] [Second Message 2.2] [Third Message 2.3] - [Try with onlt strings]
[Test Message 3.1] [52] [Second Message 3.2] [Third Message 3.3] - [hope this test works]
[Test Message 4.1] [ 72] [Second Message 4.2] [Third Message 4.3] - [Really need to see these lables picked up]

  • What did you expect to happen?
    I expect the labels to be available as part of the Label filters. This helps us in building Dashboards.

  • Can you copy/paste the configuration(s) that you are having problems with?
    Promtail Config:
    scrape_configs:

  • job_name: Logs-Analysis
    static_configs:
    • targets:
      • localhost
    • labels:
      Program: ApplicationLogs
      Environment: LOCAL
      agentIP:
      agentName:
      ServerType: WebServices
      ProjectName: Test.Project.V18
      path: D:\Program Files\AppLogs\Test.Project.5\TestStringFile.log
      pipeline_stages:
    • match:
      selector: ‘{ Program=“ApplicationLogs” }’
      stages:
      • regex:
        expression: ‘^[(?P.)] [(?P.)] [(?P.)] [(?P.)] - [(?P.*)]$’
      • labels:
        LogTest:
        LogThreadId:
        LogLevel:
        ClassName:
        LogMessage:

Note:
For some reason, the regex string is not formatted properly in the issue text box. So I have attached the screen shot of the config section.

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.
    No Errors are reported when using the following command for Promtail.
    CMD: promtail-windows-amd64.exe -config.file=promtail-local-config.yaml -check-syntax

  • Did you follow any online instructions? If so, what is the URL?
    No

Need help in resolving this regex issue under the parsing stage. I am unable to proceed further on building the config. Here I have attached the screen shot of the grafana explore of Loki data. You can see the static config labels are available. But the labels defined as part of the regex in pipeline stage is not available. Any help greatly appreciated.

Thanks
Sarath