title: Promtail config to filter out log lines
body: <p>I have read the docs for promtail and doing pipelines and I cannot make heads nor tails of it.  All I want to do is drop log lines that originated from Uptimerobot software we use to determine if our site is up or not.</p>
  <p>Promtail docs: <a href="https://grafana.com/docs/loki/latest/clients/promtail/pipelines/" rel="nofollow noreferrer">https://grafana.com/docs/loki/latest/clients/promtail/pipelines/</a></p>
  <p>The logs are in json format:</p>
  <pre><code>{ &quot;time&quot;:&quot;[17/Feb/2022:02:20:00 +0000]&quot;, &quot;remoteIP&quot;:&quot;172.18.0.4&quot;, &quot;host&quot;:&quot;api.mysite.tld&quot;, &quot;request&quot;:&quot;/v1/byUserId&quot;, &quot;query&quot;:&quot;&quot;, &quot;method&quot;:&quot;POST&quot;, &quot;status&quot;:&quot;200&quot;, &quot;userAgent&quot;:&quot;Mozilla/5.0+(compatible; UptimeRobot/2.0; http://www.uptimerobot.com/)&quot;, &quot;referer&quot;:&quot;https://api.mysite.tld/v1/byUserId&quot; }
  </code></pre>
  <p>promtail config</p>
  <pre><code>server:
    http_listen_port: 9080
    grpc_listen_port: 0
  
  positions:
    filename: /tmp/positions.yaml
  
  clients:
    - url: http://loki:3100/loki/api/v1/push
  
  scrape_configs:
  - job_name: apache_access
    static_configs:
    - targets:
        - localhost
      labels:
        job: apache_access
        __path__: /var/log/apache/site.access.log
    pipeline_stages:
      - json:
         expressions:
           userAgent: userAgent
      - drop:
         source: &quot;userAgent&quot;
         regex: &quot;.*uptimerobot.*&quot;
  
  - job_name: apache_error
    static_configs:
    - targets:
        - localhost
      labels:
        job: apache_error
        __path__: /var/log/apache/site.error.log
  </code></pre>
  <p>The above config drops all lines from the access job.</p>
  <p>How can I modify that to drop just the lines with UptimeRobot in the userAgent?</p>
  <p>EDIT</p>
  <p>Here are the promtail logs:</p>
  <pre><code>level=info ts=2022-02-23T14:26:43.416816223Z caller=server.go:260 http=[::]:9080 grpc=[::]:46085 msg=&quot;server listening on addresses&quot;
  level=info ts=2022-02-23T14:26:43.417247269Z caller=main.go:119 msg=&quot;Starting Promtail&quot; version=&quot;(version=2.4.1, branch=HEAD, revision=f61a4d261)&quot;
  level=info ts=2022-02-23T14:26:48.417542454Z caller=filetargetmanager.go:255 msg=&quot;Adding target&quot; key=&quot;/var/log/apache/site.access.log:{job=\&quot;apache_access\&quot;}&quot;
  level=info ts=2022-02-23T14:26:48.417721078Z caller=filetargetmanager.go:255 msg=&quot;Adding target&quot; key=&quot;/var/log/apache/site.error.log:{job=\&quot;apache_error\&quot;}&quot;
  ts=2022-02-23T14:26:48.417916312Z caller=log.go:168 level=info msg=&quot;Seeked /var/log/apache/site.access.log - &amp;{Offset:0 Whence:0}&quot;
  level=info ts=2022-02-23T14:26:48.417970347Z caller=tailer.go:126 component=tailer msg=&quot;tail routine: started&quot; path=/var/log/apache/site.access.log
  ts=2022-02-23T14:26:48.419048351Z caller=log.go:168 level=info msg=&quot;Seeked /var/log/apache/site.error.log - &amp;{Offset:0 Whence:0}&quot;
  level=info ts=2022-02-23T14:26:48.419071953Z caller=tailer.go:126 component=tailer msg=&quot;tail routine: started&quot; path=/var/log/apache/site.error.log
  </code></pre>
  <p>Editted to include the config changes recommended.</p>