Value looks like object, but can't find closing '}' symbol

[wannespeeters]

What's wrong?

When scraping logs with Alloy in our environment we get the following JSONParserErr in Grafana when viewing application logs.

The log on the server itself looks like this:

I am not sure what is happening here and why this is parsing incorrectly, when I copy the faulty line from grafana I get the following in notepad++.

Steps to reproduce

/

System information

Windows Server 2019

Software version

Alloy 1.5.1

Configuration

logging {
	level = "error"
}

local.file_match "logfiles" {
	path_targets = [
		{
			__path__    = "E:\\Log\\**\\*.log",
			__path_exclude__ = "E:\\Log\\**\\*stdout*",
		},
	]
}

loki.source.file "logs" {
	targets = local.file_match.logfiles.targets
	forward_to = [loki.process.processlogs.receiver]
	file_watch {
	  min_poll_frequency = "500ms"
	  max_poll_frequency = "3s"
	}
}

loki.process "processlogs" {
	forward_to = [loki.write.lokiproxy.receiver]
	stage.limit {
		rate  = 600
		burst = 800
	}
	stage.match {
		selector = "{ filename!~\".*IIS.*\" } |~ \"{.time.*}\""
		stage.json {
			expressions = {time = ""}
		}
		stage.timestamp {
			source = "time"
			format = "RFC3339Nano"
		}
		stage.regex {
			expression = "E:\\\\Log\\\\(?P<application>[^\\\\]+)\\\\(?P<component>[^\\\\]+)\\\\"
			source     = "filename"
		}
		stage.template {
			source = "app"
			template = "{{ ToLower .application }}-{{ ToLower .component }}"
		}
		stage.labels {
			values = {
				app = null,
			}
		}
		stage.static_labels {
			values= {
				type = "application",
			}
		}
	}
	stage.match {
		selector = "{ filename!~\".*IIS.*\" } !~ \"{.time.*}\""
		stage.regex {
			expression = "^(?s)(?P<time>\\S+?) "
		}
		stage.timestamp {
			source = "time"
			format = ""
			fallback_formats = ["2006-01-02","02-01-2006",]
		}
		stage.regex {
			expression = "E:\\\\Log\\\\(?P<application>[^\\\\]+)\\\\(?P<component>[^\\\\]+)\\\\"
			source     = "filename"
		}
		stage.template {
			source = "app"
			template = "{{ ToLower .application }}-{{ ToLower .component }}"
		}
		stage.labels {
			values = {
				app = null,
			}
		}
		stage.static_labels {
			values= {
				type = "application",
			}
		}
	}
	stage.match {
		selector = "{ filename=~\".*IIS.*\" }"
		stage.drop {
			expression = "#.*"
		}
		stage.regex {
			expression = "E:\\\\Log\\\\IIS\\\\(?P<application>[^\\\\]+)\\\\(?P<component>[^\\\\]+)\\\\"
			source     = "filename"
		}
		stage.template {
			source = "app"
			template = "{{ ToLower .application }}-{{ ToLower .component }}"
		}
		stage.labels {
			values = {
				app = null,
			}
		}
		stage.regex {
			expression = "(?P<timeiis>^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2})"
		}
		stage.timestamp {
			source = "timeiis"
			format = "2006-01-02 15:04:05"
		}
		stage.static_labels {
			values= {
				type = "iis",
			}
		}
	}
	stage.drop {
		older_than          = "96h"
		drop_counter_reason = "too old"
	}
}

loki.source.windowsevent "logs_winlogbeat_winlogapplication" {
	eventlog_name          = "Application"
	poll_interval          = "15s"
	exclude_event_data     = true
	use_incoming_timestamp = true
	labels				   = {type = "windowsevent"}
	forward_to             = [loki.process.logs_winlogbeat.receiver]
}

loki.process "logs_winlogbeat" {
	forward_to = [loki.write.lokiproxy.receiver]
	
	stage.drop {
	older_than          = "96h"
	drop_counter_reason = "too old"
	}
		
	stage.limit {
		rate  = 600
		burst = 800
	}
}

otelcol.receiver.otlp "receive_tracing" {
	http {}
	output {
		traces = [otelcol.processor.attributes.addenvironment.input]
	}
}

otelcol.processor.attributes "addenvironment" {
	action {
		key = "environment"
		value = env("Environment")
		action= "insert"
	}
	action {
		key = "instance"
		value = env("COMPUTERNAME")
		action= "insert"
	}
	output {
		traces = [otelcol.processor.batch.batch.input]
	}
}

otelcol.processor.batch "batch" {
	output {
		traces = [otelcol.exporter.otlphttp.tempo.input]
	}
}

Logs

[Nachtfalkeaw]

Google for
Zero width space

And maybe Check If there are newline/Multiline and you handle IT correctly.

Maybe Here
https://grafana.com/docs/loki/latest/send-data/promtail/stages/multiline/