'Drop log lines to Loki using multiple conditions with Promtail

I want to drop lines in Promtail using an AND condition from two different JSON fields.

I have JSON log lines like this.

{"timestamp":"2022-03-26T15:40:41+00:00","remote_addr":"1.2.3.4","remote_user":"","request":"GET / HTTP/1.1","status": "200","body_bytes_sent":"939","request_time":"0.000","http_referrer":"http://5.6.7.8","http_user_agent":"user agent 1"}  
{"timestamp":"2022-03-26T15:40:41+00:00","remote_addr":"1.2.3.4","remote_user":"","request":"GET /path HTTP/1.1","status": "200","body_bytes_sent":"939","request_time":"0.000","http_referrer":"http://5.6.7.8","http_user_agent":"user agent 1"}
{"timestamp":"2022-03-26T15:40:41+00:00","remote_addr":"1.2.3.4","remote_user":"","request":"GET / HTTP/1.1","status": "200","body_bytes_sent":"939","request_time":"0.000","http_referrer":"http://5.6.7.8","http_user_agent":"user agent 2"}

My local Promtail config looks like this.

clients:
  - url: http://localhost:3100/loki/api/v1/push
scrape_configs:
  - job_name: testing-my-job-drop
    pipeline_stages:
      - match:
          selector: '{job="my-job"}'
          stages:
            - json:
                expressions:
                  http_user_agent:
                  request:
            - drop:
                source: "http_user_agent"
                expression: "user agent 1"
            # I want this to be AND
            - drop:
                source: "request"
                expression: "GET / HTTP/1.1"
          drop_counter_reason: my_job_healthchecks
    static_configs:
      - labels:
          job: my-job

Using a Promtail config like this drops lines using OR from my two JSON fields.

How can I adjust my config so that I only drop lines where http_user_agent = user agent 1 AND request = GET / HTTP/1.1?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source