Promtail example extracting data from json log

docker-compose.yml

version: "3.6"

services:
  promtail:
    image: grafana/promtail:1.4.0
    container_name: promtail
    command: [ "-config.file=/etc/promtail/local-config.yaml" ]
    volumes:
      - './promtail.yml:/etc/promtail/local-config.yaml:ro'
      - '__path_to_logs_directory__:/app/log:ro'
      - promtail_data:/data
    ports:
      - "9080:9080"

volumes:
  loki_data:
    driver: local

promtail.yml

server:
  http_listen_port: 9080
  grpc_listen_port: 0
  log_level: "info"

positions:
  filename: /data/positions.yaml

client:
  url: http://__loki__address__/loki/api/v1/push
  backoff_config:
    minbackoff: 500ms
    maxbackoff: 1m
    maxretries: 99999999

scrape_configs:
  - job_name: "__service__name__" # usually the cluster name
    pipeline_stages:
#    whatever tags you can extract from your json logs
      - json:
          expressions:
            timestamp: timestamp
            message: message
            thread_name: thread_name
            level: level
            trace_id: traceId
            span_id: spanId
            stack_trace: stack_trace
      - labels:
          level:
      - timestamp:
          source: timestamp
          format: RFC3339Nano
#    create / refine labels
      - template:
          source: trace_id
          template: '{{if .Value }} {{- .Value -}} {{else}} {{- "-" -}} {{end}}'
      - template:
          source: span_id
          template: '{{if .Value }} {{- .Value -}} {{else}} {{- "-" -}} {{end}}'
      - template:
          source: stack_trace
          template: '{{if .Value }} {{- " | Stack Trace: " -}}{{- .Value -}} {{else}} {{- " " -}} {{end}}'
      - template:
          source: output
          template: '{{ ToUpper .level }} | Trace[{{ .trace_id }}] Span[{{ .span_id }}] Thread[{{ .thread_name }}] | {{ .message }}{{- .stack_trace -}}'
#    data tag used as chunk of the log
      - output:
          source: output
    static_configs:
      - targets:
          - localhost
#    the following tags will be present in all log messages
        labels:
          job: "__service_name__"
          instance: "__instance_name__" # try to match with the Prometheus instance tag so you can join the metrics with these logs.
          environment: "prod"
          __path__: /path/to/log-files*.log