Using promtail and structured_metadata to reduce output but retain full data

Question

In promtail there's an option to create structured_metadata in the pipeline. I sort of want to take the original log message and store it into the map and then put it in structured metadata as log to represent the original log message.

Then I want to extract the "message" value and store that as an output.

I think the last bits of it would be

- json:
    expressions:
      message: message
- output:
    source: message
- structured_metadata:
    log:

But I am not sure how to do the first step which is to absorb the original line.

Answer 1

TL;DR

      - regex:
          expression: (?P<log>.+)

So the whole thing is

- regex:
    expression: (?P<log>.+)
- json:
    expressions:
      message: message
- output:
    source: message
- structured_metadata:
    log: