add traefik access log level parsing in alloy (status code -> level)

argocd/apps/alloy.yaml

@@ -83,6 +83,30 @@ spec:
                 }
               }
 
+              // Parse Traefik access logs to derive log level from HTTP status code
+              loki.process "traefik-level" {
+                forward_to = [loki.process.filter.receiver]
+
+                stage.match {
+                  selector = "{service=\"traefik\"}"
+
+                  stage.regex {
+                    expression = `\"\w+ .+ HTTP/[\d.]+\" (?P<status_code>[0-9]{3}) `
+                  }
+
+                  stage.template {
+                    source   = "level"
+                    template = `{{ if eq (printf "%.1s" .status_code) "5" }}error{{ else if eq (printf "%.1s" .status_code) "4" }}warn{{ else }}info{{ end }}`
+                  }
+
+                  stage.labels {
+                    values = {
+                      level = "",
+                    }
+                  }
+                }
+              }
+
               // Filter out noisy fsnotify/inotify errors from Loki and ArgoCD
               loki.process "filter" {
                 forward_to = [loki.write.loki.receiver]
@@ -96,7 +120,7 @@ spec:
               // Collect logs from Kubernetes pods using the Kubernetes API
               loki.source.kubernetes "pods" {
                 targets    = discovery.relabel.pods.output
-                forward_to = [loki.process.filter.receiver]
+                forward_to = [loki.process.traefik-level.receiver]
               }
 
               // Write logs to Loki