loki/fluentd/fluent-plugin-grafana-loki/docker/conf/systemd.conf

# Logs from systemd-journal
<source>
  @type systemd
  @id in_systemd_kubelet
  tag journald
  <storage>
    @type local
    persistent true
    path /var/log/fluentd-journald-cursor.json
  </storage>
  read_from_head false
  <entry>
    fields_lowercase false
    field_map {"_PID": "PID", "MESSAGE": "message",  "SYSLOG_IDENTIFIER": "identifier", "_HOSTNAME": "HOSTNAME", "PRIORITY": "PRIORITY"}
    field_map_strict true
  </entry>
</source>

<filter journald>
  @type record_transformer
  enable_ruby true
  remove_keys ["PRIORITY", "HOSTNAME"]
  <record>
    # add a "job" label
    job default/journald

    # re-label the HOSTNAME to "instance"
    instance ${record["HOSTNAME"]}

    # change priority from an int to a string.
    level ${record["PRIORITY"] ? record["PRIORITY"] == "0" ? "EMERG" : record["PRIORITY"] == "1" ? "ALERT" : record["PRIORITY"] == "2" ? "CRIT" : record["PRIORITY"] == "3" ? "ERROR" : record["PRIORITY"] == "4" ? "WARN" : record["PRIORITY"] == "5" ? "NOTICE" : record["PRIORITY"] == "6" ? "INFO" : record["PRIORITY"] == "7" ? "DEBUG" : record["PRIORITY"] : "unset"}
  </record>
</filter>