---
title: "Grafana Alloy"
sidebar_label: "Grafana Alloy"
description: "How to configure Grafana Alloy to receive events in your infrastructure"
sidebar_position: 4
---
import Formbricks from '@theme/MDXComponents/Formbricks';
import IssueS3Key from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/common/issue-s3-key.mdx';
# Grafana Alloy
[Grafana Alloy](https://grafana.com/docs/alloy/latest/) is an agent for collecting and forwarding metrics, logs, and traces. Grafana Alloy is a flexible and high-performance distribution of [OpenTelemetry Collector](https://opentelemetry.io/ecosystem/distributions/). The agent is compatible with OpenTelemetry and Prometheus — the most common observability standards.
Grafana Alloy uses the [otel-colector/awscloudwatchreceiver](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/v0.128.0/receiver/awscloudwatchreceiver/logs.go#L278) component, which receives logs from the [FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) method of the Amazon CloudWatch API. You can view the list of all Grafana Alloy components in the [Choose a Grafana Alloy component](https://grafana.com/docs/alloy/latest/collect/choose-component/) guide in the official Grafana documentation.
1. [Add a service user](#add-service-user).
2. [Issue an S3 key to the user](#issue-s3-key).
3. [Install the agent](#install-agent).
4. [Configure the agent to receive events](#configure-agent-to-receive-events).
## 1. Add a service user \{#add-service-user}
[Add a service user](/access-control/manage/add-user.mdx#add-service-user) with permission in the **Projects** area and the role:
* [`member`](/access-control/role-reference.mdx#member) or [`logs.admin`](/logs/manage-access.mdx#logs-admin) for read and write log access;
* [`logs.write`](/logs/manage-access.mdx#logs-writer) for write log access;
* [`reader`](/access-control/role-reference.mdx#reader) or [`logs.viewer`](/logs/manage-access.mdx#logs-viewer) for read-only log access.
Users can be added by the [Account Owner](/access-control/user-types.mdx#account-owner) or by users with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role.
## 2. Issue an S3 key to the user \{#issue-s3-key}
## 3. Install the agent \{#install-agent}
Use the [Install Grafana Alloy](https://grafana.com/docs/alloy/latest/set-up/install/) instructions in the official Grafana Alloy documentation.
## 4. Configure the agent to receive events \{#configure-agent-to-receive-events}
1. Open the CLI.
2. Create a `config.alloy` configuration file:
```bash
nano /etc/alloy/config.alloy
```
3. In the `config.alloy` file, add the configuration to receive events using the [otelcol.receiver.awscloudwatch](https://grafana.com/docs/alloy/latest/reference/components/otelcol/otelcol.receiver.awscloudwatch/) component. Example configuration:
```bash
logging {
level = "info"
format = "logfmt"
}
otelcol.receiver.awscloudwatch "logs" {
region = ""
logs {
groups {
named {
group_name = ""
names = ""
}
}
}
output {
logs = [otelcol.exporter.loki.default.input]
}
}
otelcol.exporter.loki "default" {
forward_to = [loki.process.parse_json.receiver]
}
loki.process "parse_json" {
stage.json {
expressions = {
source = "",
}
}
stage.output {
source = ""
}
forward_to = [loki.echo.default.receiver]
}
loki.echo "default" {}
```
Specify:
* arguments for the [otelcol.receiver.awscloudwatch](https://grafana.com/docs/alloy/latest/reference/components/otelcol/otelcol.receiver.awscloudwatch/) component:
* `` — [pool](/infrastructure/locations.mdx#pool), for example `ru-9`;
* `` — log group name, for example `s/lbaas/Loabalancer-1`;
* optional: `` — a list of streams to receive events from, for example `[http-c48d78e2-6f49-43b5-80b7-2f2b8e5f669d]`.
* arguments for the [loki.process](https://grafana.com/docs/alloy/latest/reference/components/loki/loki.process/) component:
* `` — event field, for example `body`. The value for processing will be extracted from the field specified in the `stage.json` parameter. The value of the field specified in the `stage.output` parameter will be sent to the output after processing.
2. Run Alloy:
```bash
docker run \
-v /etc/alloy/config.alloy:/etc/alloy/config.alloy \
-p 12345:12345 \
-e AWS_ENDPOINT_URL= \
-e AWS_ACCESS_KEY= \
-e AWS_SECRET_KEY= \
grafana/alloy:latest \
run --server.http.listen-addr=0.0.0.0:12345 \
--storage.path=/var/lib/alloy/data \
--stability.level experimental \
/etc/alloy/config.alloy
```
Specify:
* `` — the URL for accessing the Logs service API. The list of URLs can be found in the [Logs](/api/urls/#logs) subsection of the [List of URLs](/api/urls/) guide;
* `` — the value of the **Access key** field from the S3 key that you [issued to the user](#issue-s3-key);
* `` — the value of the **Secret key** field from the S3 key that you [issued to the user](#issue-s3-key).
You can add ``, `` and `` to the container using any of the following methods:
* via environment variables, see the [Using environment variables to globally configure AWS SDKs and tools](https://docs.aws.amazon.com/sdkref/latest/guide/environment-variables.html) guide in the Amazon documentation;
* or via `config` and `credentials` files, see the [Using shared config and credentials files to globally configure AWS SDKs and tools](https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html) guide in the Amazon documentation.
Example of output to stdout:
```bash
...
ts=2025-10-14T06:07:03.637492043Z level=info component_path=/ component_id=loki.echo.default receiver=loki.echo.default entry="{\"client\":\"204.76.203.219:41942\" ... }" entry_timestamp=2025-10-14T05:50:35.549Z labels="{exporter=\"OTLP\"}" structured_metadata={}
ts=2025-10-14T06:07:03.637503251Z level=info component_path=/ component_id=loki.echo.default receiver=loki.echo.default entry="{\"client\":\"204.76.203.18:45864\" ... }" entry_timestamp=2025-10-14T05:54:58.753Z labels="{exporter=\"OTLP\"}" structured_metadata={}
...
```