Additional label by regex of log lines

[orlovds]

Good day,
There is a text log with the following lines:
25-Oct-2024 13:02:09.497 info: client @0x7f5ee414b5d0 10..x.y.z#59452 (grafana.it.jab): query: grafana.it.jab IN A +E(0) (10.255.30.21)

I wrote such an attempt:

loki.relabel "dns_logs" {
  forward_to = [loki.write.ext.receiver]

  rule {
    target_label = "dns_request"
    regex = "((.+?)):"
    replacement = "${1}"
  }
}

I waiting label "dns_request" with value "grafana.it.jab", but they are not there...
Can you tell me the reason?

Thank you in advance!

[Nachtfalkeaw]

Hello,

I think you need to define the proper "source_labels" or your "grafana.it.jab" is not in a label so can not be matched and regexed and replaced.