// ============================================================================
//  Grafana Alloy — the ONLY monitoring agent on a Windows host.
//
//  Collects metrics (windows_exporter, built into Alloy) and the Windows Event
//  Log, and PUSHES both over HTTPS to the monitoring server. Nothing listens
//  on this host; only outbound 443 is needed.
//
//  TEMPLATE: install.ps1 substitutes __NODE_NAME__, __INGEST_URL__ and
//  __TOKEN_FILE__ and writes the result to
//  C:\Program Files\GrafanaLabs\Alloy\config.alloy.
// ============================================================================

logging {
	level  = "info"
	format = "logfmt"
}

// ---- metrics ------------------------------------------------------------------
// windows_exporter, built in. Same metric names (windows_*), so the
// dashboards and windows.rules.yml apply.
prometheus.exporter.windows "default" {
	enabled_collectors = ["cpu", "cs", "logical_disk", "memory", "net", "os", "service", "system"]
}

// Label the series like every other host: job="windows", instance=<name>.
discovery.relabel "windows" {
	targets = prometheus.exporter.windows.default.targets

	rule {
		target_label = "job"
		replacement  = "windows"
	}
	rule {
		target_label = "instance"
		replacement  = "__NODE_NAME__"
	}
}

prometheus.scrape "windows" {
	targets         = discovery.relabel.windows.output
	scrape_interval = "30s"
	forward_to      = [prometheus.relabel.trim.receiver]
}

// The service collector reports one series per service per state / start
// mode (thousands). Keep what the alerts and dashboards use.
prometheus.relabel "trim" {
	forward_to = [prometheus.remote_write.ingest.receiver]

	rule {
		source_labels = ["__name__", "state"]
		regex         = "windows_service_state;(continue pending|pause pending|paused|start pending|stop pending|unknown)"
		action        = "drop"
	}
	rule {
		source_labels = ["__name__", "start_mode"]
		regex         = "windows_service_start_mode;(boot|disabled|manual|system)"
		action        = "drop"
	}
}

// Buffered in a write-ahead log: if the server is unreachable, metrics are
// sent once it is back.
prometheus.remote_write "ingest" {
	endpoint {
		url               = "__INGEST_URL__/api/v1/write"
		bearer_token_file = "__TOKEN_FILE__"
	}
}

// ---- logs ---------------------------------------------------------------------
loki.write "default" {
	endpoint {
		url               = "__INGEST_URL__/loki/api/v1/push"
		bearer_token_file = "__TOKEN_FILE__"
	}
	external_labels = {
		host = "__NODE_NAME__",
	}
}

loki.source.windowsevent "application" {
	eventlog_name          = "Application"
	use_incoming_timestamp = true
	labels                 = { job = "windows-event", channel = "application" }
	forward_to             = [loki.write.default.receiver]
}

loki.source.windowsevent "system" {
	eventlog_name          = "System"
	use_incoming_timestamp = true
	labels                 = { job = "windows-event", channel = "system" }
	forward_to             = [loki.write.default.receiver]
}

// Security channel is high-volume; enable if you need auth auditing in Loki.
// loki.source.windowsevent "security" {
// 	eventlog_name          = "Security"
// 	use_incoming_timestamp = true
// 	labels                 = { job = "windows-event", channel = "security" }
// 	forward_to             = [loki.write.default.receiver]
// }