Grafana Alloy components reference

1. Introduction to Alloy components #

Components are the building blocks of every Grafana Alloy pipeline. Each configuration block in a `.river` file defines a component. Components are interconnected to form a data processing graph (DAG), where the output (export) of one component serves as the input (argument) of another.

2. `loki` components #

Components dedicated to collecting, processing and sending logs to Grafana Loki.

loki.source.file #

Available in: ✓ OSS ✓ Enterprise ✓ Cloud

Tails new lines from local files. It is the equivalent of Promtail.

Example configuration:

loki.source.file "default" {
  targets    = local.file_match.logs.targets
  forward_to = [loki.write.local.receiver]
}

loki.source.journal #

Reads logs directly from the systemd journal (journald) on Linux systems.

Example configuration:

loki.source.journal "default" {
  forward_to = [loki.write.local.receiver]
}

loki.source.docker #

Reads logs directly from the Docker daemon.

Example configuration:

loki.source.docker "default" {
  host       = "unix:///var/run/docker.sock"
  targets    = discovery.docker.local.targets
  forward_to = [loki.write.local.receiver]
}

loki.source.kubernetes #

Reads logs from the pods of a Kubernetes cluster.

Example configuration:

loki.source.kubernetes "default" {
  targets    = discovery.kubernetes.pods.targets
  forward_to = [loki.write.local.receiver]
}

loki.source.syslog #

Acts as a Syslog server to receive logs sent over the network.

Example configuration:

loki.source.syslog "default" {
  listener {
    address  = "0.0.0.0:514"
    protocol = "tcp"
  }
  forward_to = [loki.write.local.receiver]
}

loki.source.windowsevent #

Collects events from the Windows Event Log.

Example configuration:

loki.source.windowsevent "default" {
  eventlog_name = "Application"
  forward_to    = [loki.write.local.receiver]
}

loki.source.kafka #

Consumes messages from one or more Kafka topics.

Example configuration:

loki.source.kafka "default" {
  brokers    = ["kafka:9092"]
  topics     = ["logs"]
  forward_to = [loki.write.local.receiver]
}

loki.source.gcplog #

Retrieves logs from Google Cloud Logging.

Example configuration:

loki.source.gcplog "default" {
  project_id   = "my-project"
  subscription = "my-sub"
  forward_to   = [loki.write.local.receiver]
}

loki.source.podlogs #

Collects Kubernetes pod logs using the native kubelet podLogs API (a modern alternative to `loki.source.kubernetes`).

Example configuration:

loki.source.podlogs "default" {
  targets    = discovery.kubernetes.pods.targets
  forward_to = [loki.write.local.receiver]
}

loki.source.api #

Receives logs directly through a basic HTTP API.

Example configuration:

loki.source.api "default" {
  http {
    listen_address = "0.0.0.0:9999"
  }
  forward_to = [loki.write.local.receiver]
}

loki.source.cloudflare #

Acts as an HTTP server to receive logs sent by Cloudflare Logpush.

Example configuration:

loki.source.cloudflare "default" {
  listen_address = "0.0.0.0:8080"
  forward_to     = [loki.write.local.receiver]
}

loki.source.awsfirehose #

Receives logs pushed by AWS Kinesis Data Firehose.

Example configuration:

loki.source.awsfirehose "default" {
  http {
    listen_address = "0.0.0.0:8080"
  }
  forward_to = [loki.write.local.receiver]
}

loki.source.azure_event_hubs #

Consumes logs from an Azure Event Hub.

Example configuration:

loki.source.azure_event_hubs "default" {
  fully_qualified_namespace = "my-namespace.servicebus.windows.net"
  event_hub                 = "my-hub"
  forward_to                = [loki.write.local.receiver]
}

loki.process #

Applies a series of processing stages to parse, transform or filter logs (e.g. parse JSON, extract labels with a regex).

Example configuration:

loki.process "default" {
  forward_to = [loki.write.local.receiver]
  stage.json {
    expressions = { "level" = "level" }
  }
}

loki.relabel #

Modifies the labels of a log stream before sending it to Loki.

Example configuration:

loki.relabel "default" {
  forward_to = [loki.write.local.receiver]
  rule {
    action        = "keep"
    source_labels = ["app"]
    regex         = "myapp"
  }
}

loki.write #

Sends processed logs to a Grafana Loki instance.

Example configuration:

loki.write "local" {
  endpoint {
    url = "http://loki:3100/loki/api/v1/push"
  }
}

3. `prometheus` components #

Components for scraping, processing and sending metrics in Prometheus format.

prometheus.scrape #

Scrapes metrics from one or more HTTP endpoints in Prometheus format.

Example configuration:

// Scrape une cible statique toutes les 15 secondes
prometheus.scrape "default" {
  targets = [{"__address__" = "localhost:9090"}]
  forward_to = [prometheus.remote_write.mimir.receiver]
  scrape_interval = "15s"
}

prometheus.relabel #

Relabels metrics before ingestion.

Example configuration:

prometheus.relabel "default" {
  forward_to = [prometheus.remote_write.local.receiver]
  rule {
    action        = "drop"
    source_labels = ["__name__"]
    regex         = "up"
  }
}

prometheus.remote_write #

Sends collected metrics to a Prometheus Remote Write compatible backend (such as Mimir, Thanos or VictoriaMetrics).

Example configuration:

prometheus.remote_write "local" {
  endpoint {
    url = "http://mimir:9009/api/v1/push"
  }
}

prometheus.receive_http #

Acts as an endpoint that accepts `remote_write` requests from other Prometheus agents.

Example configuration:

prometheus.receive_http "default" {
  forward_to = [prometheus.remote_write.local.receiver]
}

prometheus.rule #

Evaluates Prometheus recording or alerting rules.

Example configuration:

prometheus.rule "default" {
  rule_path  = "/etc/alloy/rules"
  forward_to = [prometheus.alertmanager.local.receiver]
}

prometheus.alertmanager #

Manages the life cycle of alerts (grouping, inhibition, routing) generated by `prometheus.rule`.

Example configuration:

prometheus.alertmanager "local" {
  endpoints = ["http://alertmanager:9093"]
}

prometheus.exporter.unix #

Collects metrics from a Linux or Unix system (equivalent of `node_exporter`).

Example configuration with the textfile module:

// Active l'exportateur unix avec des collecteurs spécifiques
prometheus.exporter.unix "default" {
  enable_collectors = ["cpu", "meminfo", "textfile"]
  // Configure le dossier pour le module textfile
  textfile {
    directory = "/var/lib/node_exporter/textfile_collector"
  }
}

prometheus.exporter.windows #

Collects metrics from a Windows system (equivalent of `windows_exporter`).

Example configuration:

prometheus.exporter.windows "default" {
  enable_collectors = ["cpu", "cs", "logical_disk"]
}

prometheus.exporter.blackbox #

Probes endpoints (HTTP, TCP, ICMP) for availability tests.

Example configuration:

prometheus.exporter.blackbox "default" {
  config_file = "/etc/blackbox.yml"
  targets = [{
    name    = "example.com",
    address = "https://example.com"
  }]
}

prometheus.exporter.consul #

Exposes the health metrics of a Consul cluster.

Example configuration:

prometheus.exporter.consul "default" {
  server = "http://localhost:8500"
}

prometheus.exporter.postgres #

Collects metrics from a PostgreSQL database.

Example configuration:

prometheus.exporter.postgres "default" {
  data_source_names = ["postgresql://user:pass@localhost:5432/db?sslmode=disable"]
}

prometheus.exporter.mysql #

Collects metrics from a MySQL or MariaDB database.

Example configuration:

prometheus.exporter.mysql "default" {
  data_source_name = "user:pass@(localhost:3306)/"
}

prometheus.exporter.self #

Exposes the internal health and performance metrics of Grafana Alloy itself.

Example configuration:

// Active l'exportateur interne d'Alloy
prometheus.exporter.self "default" {}

// Scrape les métriques générées par l'exportateur interne
prometheus.scrape "scrape_alloy" {
  targets    = prometheus.exporter.self.default.targets
  forward_to = [prometheus.remote_write.mimir.receiver]
}

prometheus.exporter.redis #

Collects metrics from a Redis instance.

Example configuration:

prometheus.exporter.redis "default" {
  redis_addr = "redis:6379"
}

prometheus.exporter.elasticsearch #

Collects metrics from an Elasticsearch cluster.

Example configuration:

prometheus.exporter.elasticsearch "default" {
  address = "http://elasticsearch:9200"
}

prometheus.exporter.mongodb #

Collects metrics from a MongoDB server.

Example configuration:

prometheus.exporter.mongodb "default" {
  mongodb_uri = "mongodb://user:pass@mongodb:27017"
}

prometheus.exporter.kafka #

Collects metrics from an Apache Kafka cluster.

Example configuration:

prometheus.exporter.kafka "default" {
  kafka_uris = ["kafka:9092"]
}

prometheus.exporter.memcached #

Collects metrics from a Memcached server.

Example configuration:

prometheus.exporter.memcached "default" {
  address = "memcached:11211"
}

prometheus.exporter.snmp #

Collects metrics from network devices using the SNMP protocol.

Example configuration:

prometheus.exporter.snmp "default" {
  targets = [{
    name    = "router",
    address = "192.168.1.1",
    module  = "if_mib"
  }]
}

prometheus.exporter.cadvisor #

Exposes metrics about running containers (CPU usage, memory, cgroups).

Example configuration:

prometheus.exporter.cadvisor "default" {
  docker_host = "unix:///var/run/docker.sock"
}

prometheus.exporter.github #

Collects metrics from GitHub repositories and Actions.

Example configuration:

prometheus.exporter.github "default" {
  api_token = sys.env("GITHUB_TOKEN")
  repositories = ["grafana/alloy"]
}

4. `prometheus.operator` components #

Components that interact natively with Prometheus Operator Custom Resources (CRDs) in Kubernetes.

prometheus.operator.podmonitors #

Automatically discovers and scrapes targets defined through the Kubernetes PodMonitor Custom Resource (CRD).

Example configuration:

prometheus.operator.podmonitors "default" {
  forward_to = [prometheus.remote_write.mimir.receiver]
}

prometheus.operator.servicemonitors #

Discovers and scrapes targets defined through the ServiceMonitor Custom Resource.

Example configuration:

prometheus.operator.servicemonitors "default" {
  forward_to = [prometheus.remote_write.mimir.receiver]
}

prometheus.operator.probes #

Discovers and runs the Blackbox checks defined through the Probe Custom Resource.

Example configuration:

prometheus.operator.probes "default" {
  forward_to = [prometheus.remote_write.mimir.receiver]
}

5. `otelcol` components (OpenTelemetry) #

Components from the OpenTelemetry Collector, enabling full interoperability with the OTLP ecosystem.

otelcol.receiver.otlp #

Accepts metrics, logs and traces over the native OpenTelemetry protocol (gRPC or HTTP).

Example configuration:

otelcol.receiver.otlp "default" {
  grpc { endpoint = "0.0.0.0:4317" }
  http { endpoint = "0.0.0.0:4318" }
  output {
    metrics = [otelcol.processor.batch.default.input]
  }
}

otelcol.receiver.jaeger #

Accepts traces in Jaeger format.

Example configuration:

otelcol.receiver.jaeger "default" {
  protocols {
    grpc { endpoint = "0.0.0.0:14250" }
  }
  output {
    traces = [otelcol.processor.batch.default.input]
  }
}

otelcol.receiver.zipkin #

Accepts traces in Zipkin format.

Example configuration:

otelcol.receiver.zipkin "default" {
  endpoint = "0.0.0.0:9411"
  output {
    traces = [otelcol.processor.batch.default.input]
  }
}

otelcol.receiver.kafka #

Consumes telemetry data from a Kafka topic.

Example configuration:

otelcol.receiver.kafka "default" {
  brokers          = ["kafka:9092"]
  protocol_version = "2.0.0"
  output {
    logs = [otelcol.processor.batch.default.input]
  }
}

otelcol.receiver.filelog #

Reads logs from local files (similar to `loki.source.file` but in OTLP format).

Example configuration:

otelcol.receiver.filelog "default" {
  include = ["/var/log/*.log"]
  output {
    logs = [otelcol.processor.batch.default.input]
  }
}

otelcol.receiver.prometheus #

Accepts `remote_write` requests in Prometheus format.

Example configuration:

otelcol.receiver.prometheus "default" {
  output {
    metrics = [otelcol.processor.batch.default.input]
  }
}

otelcol.processor.attributes #

Adds, modifies or deletes attributes on telemetry data.

Example configuration:

otelcol.processor.attributes "default" {
  action {
    action = "insert"
    key    = "env"
    value  = "prod"
  }
  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.processor.batch #

Groups data into batches before sending it, to optimize network throughput.

Example configuration:

otelcol.processor.batch "default" {
  timeout         = "1s"
  send_batch_size = 1000
  output {
    metrics = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.processor.memory_limiter #

Prevents Alloy from consuming too much memory under heavy load.

Example configuration:

otelcol.processor.memory_limiter "default" {
  check_interval = "1s"
  limit_mib      = 1000
  output {
    metrics = [otelcol.processor.batch.default.input]
  }
}

otelcol.processor.tail_sampling #

Samples traces based on policies (e.g. keep only traces with errors).

Example configuration:

otelcol.processor.tail_sampling "default" {
  policy {
    name = "errors"
    type = "status_code"
    status_code { status_codes = ["ERROR"] }
  }
  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.processor.transform #

Applies powerful transformations to telemetry data using OTTL (OpenTelemetry Transform Language).

Example configuration:

otelcol.processor.transform "default" {
  error_mode = "ignore"
  trace_statements = [
    "set(resource.attributes[\"env\"], \"prod\")"
  ]
  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.processor.resourcedetection #

Automatically detects information about the runtime environment (cloud provider, OS, Kubernetes) and adds it as attributes.

Example configuration:

otelcol.processor.resourcedetection "default" {
  detectors = ["env", "system"]
  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.processor.probabilistic_sampler #

Samples traces with a fixed probability, useful to reduce data volume at scale.

Example configuration:

otelcol.processor.probabilistic_sampler "default" {
  sampling_percentage = 10
  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

otelcol.exporter.otlp #

Sends telemetry data to a backend compatible with OTLP over gRPC (default port: 4317).

Example configuration:

otelcol.exporter.otlp "default" {
  client {
    endpoint = "tempo:4317"
  }
}

otelcol.exporter.otlphttp #

Sends telemetry data to a backend compatible with OTLP over HTTP (default port: 4318).

Example configuration:

otelcol.exporter.otlphttp "default" {
  client {
    endpoint = "http://mimir:8080/otlp"
  }
}

otelcol.exporter.loki #

Converts and sends OTLP logs to Grafana Loki.

Example configuration:

otelcol.exporter.loki "default" {
  forward_to = [loki.write.local.receiver]
}

otelcol.exporter.prometheus #

Exposes OTLP metrics on an endpoint that Prometheus can scrape.

Example configuration:

otelcol.exporter.prometheus "default" {
  forward_to = [prometheus.remote_write.local.receiver]
}

otelcol.auth.basic #

Handles `Basic Auth` authentication (username/password).

Example configuration:

otelcol.auth.basic "default" {
  username = "admin"
  password = "password"
}

otelcol.auth.bearer #

Handles token authentication (Bearer Token).

Example configuration:

otelcol.auth.bearer "default" {
  token = "my-secret-token"
}

otelcol.auth.oauth2 #

Handles authentication through the OAuth2 protocol.

Example configuration:

otelcol.auth.oauth2 "default" {
  client_id     = "my-client"
  client_secret = "secret"
  token_url     = "https://example.com/oauth2/token"
}

6. `discovery` components #

Components for dynamically discovering targets to monitor in changing environments.

discovery.kubernetes #

Automatically discovers pods, services, endpoints and ingresses in a Kubernetes cluster.

Example configuration:

discovery.kubernetes "pods" {
  role = "pod"
}

discovery.docker #

Discovers Docker containers running on the local machine.

Example configuration:

discovery.docker "local" {
  host = "unix:///var/run/docker.sock"
}

discovery.ec2 #

Discovers EC2 instances in an AWS account.

Example configuration:

discovery.ec2 "default" {
  region = "eu-west-1"
}

discovery.gce #

Discovers VM instances in Google Compute Engine.

Example configuration:

discovery.gce "default" {
  project = "my-gcp-project"
  zone    = "europe-west1-b"
}

discovery.azure #

Discovers virtual machines in Microsoft Azure.

Example configuration:

discovery.azure "default" {
  subscription_id = "my-sub-id"
}

discovery.consul #

Discovers services registered in a HashiCorp Consul cluster.

Example configuration:

discovery.consul "default" {
  server = "localhost:8500"
}

discovery.dns #

Discovers targets through DNS records (A, AAAA, SRV).

Example configuration:

discovery.dns "default" {
  names = ["example.com"]
  type  = "A"
}

discovery.file #

Reads a list of targets from a JSON or YAML file.

Example configuration:

discovery.file "default" {
  files = ["/etc/alloy/targets.json"]
}

discovery.http #

Discovers targets by querying an HTTP endpoint.

Example configuration:

discovery.http "default" {
  url = "http://example.com/targets"
}

discovery.process #

Discovers processes running on the local machine.

Example configuration:

discovery.process "default" {
  discover_all = true
}

discovery.relabel #

Applies relabeling rules to discovered targets.

Example configuration:

discovery.relabel "default" {
  targets = discovery.kubernetes.pods.targets
  rule {
    action        = "keep"
    source_labels = ["__meta_kubernetes_pod_label_app"]
    regex         = "myapp"
  }
}

discovery.digitalocean #

Discovers instances (Droplets) in DigitalOcean.

Example configuration:

discovery.digitalocean "default" {
  bearer_token = sys.env("DO_TOKEN")
}

discovery.linode #

Discovers instances in Linode.

Example configuration:

discovery.linode "default" {
  bearer_token = sys.env("LINODE_TOKEN")
}

discovery.scaleway #

Discovers resources in Scaleway (e.g. instances, bare metal).

Example configuration:

discovery.scaleway "default" {
  project_id = "my-project-id"
  access_key = sys.env("SCW_ACCESS_KEY")
  secret_key = sys.env("SCW_SECRET_KEY")
}

discovery.nomad #

Discovers services and applications running in a HashiCorp Nomad cluster.

Example configuration:

discovery.nomad "default" {
  server = "http://nomad.service.consul:4646"
}

7. `pyroscope` components #

Components for collecting and sending continuous performance profiles to Grafana Pyroscope.

pyroscope.scrape #

Collects performance profiles from pprof-compatible endpoints (Go's standard format).

Example configuration:

pyroscope.scrape "default" {
  targets    = [{"__address__" = "localhost:8080"}]
  forward_to = [pyroscope.write.local.receiver]
}

pyroscope.write #

Sends collected profiles to a Grafana Pyroscope instance.

Example configuration:

pyroscope.write "local" {
  endpoint {
    url = "http://pyroscope:4040"
  }
}

pyroscope.ebpf #

Collects performance (CPU) profiles of Linux applications using eBPF, without requiring code instrumentation.

Example configuration:

pyroscope.ebpf "default" {
  forward_to = [pyroscope.write.local.receiver]
  targets    = discovery.process.local.targets
}

8. `beyla` and `faro` components #

Components for auto-instrumentation and front-end telemetry collection.

beyla.ebpf #

Uses eBPF to auto-instrument applications (Go, C++, Rust...) without changing their code, generating traces and metrics (RED: Rate, Errors, Duration).

Example configuration:

beyla.ebpf "default" {
  open_port = 8080
  output {
    traces = [otelcol.exporter.otlp.default.input]
  }
}

faro.receiver #

Acts as a collection point for signals sent by the Grafana Faro SDK (Real User Monitoring for the front end).

Example configuration:

faro.receiver "default" {
  server {
    listen_address = "0.0.0.0:12347"
  }
  output {
    logs = [loki.write.local.receiver]
  }
}

9. Utility components #

Generic components for handling files and strings and for HTTP communication.

local.file_match #

Discovers files on the local file system based on a pattern. Useful to feed `loki.source.file`.

Example configuration:

local.file_match "logs" {
  path_targets = [{"__path__" = "/var/log/*.log"}]
}

local.file #

Reads the content of a file on disk and exposes it as a string.

Example configuration:

local.file "secret" {
  filename  = "/etc/secret.txt"
  is_secret = true
}

remote.http #

Retrieves the content of a remote resource over HTTP.

Example configuration:

remote.http "config" {
  url            = "http://example.com/config.json"
  poll_frequency = "5m"
}

remote.vault #

Dynamically retrieves and renews secrets from HashiCorp Vault.

Example configuration:

remote.vault "db_credentials" {
  server = "http://vault:8200"
  path   = "secret/data/db"
  auth {
    token = sys.env("VAULT_TOKEN")
  }
}

remote.kubernetes.secret #

Dynamically reads and updates secrets from the Kubernetes API.

Example configuration:

remote.kubernetes.secret "api_keys" {
  name      = "my-secret"
  namespace = "default"
}

remote.kubernetes.configmap #

Dynamically reads and updates the content of Kubernetes ConfigMaps.

Example configuration:

remote.kubernetes.configmap "app_config" {
  name      = "my-configmap"
  namespace = "default"
}

remote.s3 #

Periodically downloads the content of an object (e.g. a configuration file) from an S3 bucket.

Example configuration:

remote.s3 "targets" {
  endpoint = "s3.eu-west-1.amazonaws.com"
  bucket   = "my-configs"
  path     = "targets.json"
  key      = sys.env("AWS_ACCESS_KEY")
  secret   = sys.env("AWS_SECRET_KEY")
}