Enrichment of log data

[Mattias Winther]

What are the approaches one should look at when it comes to enriching data from Loki with additional data when visualizing?

Using GeoIP data as an example, one option would be to get rsyslog or similar to do the lookup, add the relevant fields to the log line, and then put everything into Loki. But there's something to be said for maintaining the log lines as they are, as well as not adding more data to each log line than necessary, especially with high volume logs.

My sense is that after getting the query results back from loki, it would make the most sense to add the GeoIP location data at that point. That means, either finding a way to do so in Grafana, which I so far haven't been able to find, or writing some kind of proxy that performs the loki queri, does the enriching once the results are back, and then provide that result to Grafana. This doesn't seem to work out of the box, but with the custom JSON endpoint datasource I imagine it would be possible to approach it like this.

It seems to me that this really is a Grafana problem rather than a Loki problem for my particular case, but it seems there would be cases where you'd want to do the enrichment in Loki instead. Is this planned functionality?