From dca174717cc99b797e9825b1a4e07e51b9ecff86 Mon Sep 17 00:00:00 2001
From: Cody Lee <cody.lee@datadoghq.com>
Date: Mon, 23 Mar 2026 15:32:43 -0500
Subject: [PATCH] feat(lokiunifi): add richer low-cardinality stream labels
 (#932)

- Add job=unpoller to every Loki stream (alarm, anomaly, event, ids,
  system_log, protect_log, protect_thumbnail) for standard Grafana/Loki
  source filtering with {job="unpoller"}
- Add event_type and inner_alert_action labels to IDS streams using
  EventType and InnerAlertAction fields
- Add event_type and inner_alert_action labels to Alarm streams using
  Key and InnerAlertAction fields
- Skip severity/category on Anomaly: the unifi.Anomaly struct has no
  such fields

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 pkg/lokiunifi/report_alarm.go   | 9 ++++++---
 pkg/lokiunifi/report_anomaly.go | 1 +
 pkg/lokiunifi/report_event.go   | 2 ++
 pkg/lokiunifi/report_ids.go     | 9 ++++++---
 pkg/lokiunifi/report_protect.go | 2 ++
 5 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/pkg/lokiunifi/report_alarm.go b/pkg/lokiunifi/report_alarm.go
index 1ae85852..fd874479 100644
--- a/pkg/lokiunifi/report_alarm.go
+++ b/pkg/lokiunifi/report_alarm.go
@@ -27,9 +27,12 @@ func (r *Report) Alarm(event *unifi.Alarm, logs *Logs) {
 	logs.Streams = append(logs.Streams, LogStream{
 		Entries: [][]string{{strconv.FormatInt(event.Datetime.UnixNano(), 10), string(msg)}},
 		Labels: CleanLabels(MergeLabels(map[string]string{
-			"application": "unifi_alarm",
-			"source":      event.SourceName,
-			"site_name":   event.SiteName,
+			"application":        "unifi_alarm",
+			"job":                "unpoller",
+			"source":             event.SourceName,
+			"site_name":          event.SiteName,
+			"event_type":         event.Key,
+			"inner_alert_action": event.InnerAlertAction,
 		}, r.ExtraLabels)),
 	})
 }
diff --git a/pkg/lokiunifi/report_anomaly.go b/pkg/lokiunifi/report_anomaly.go
index d9ca734a..d2eefdd3 100644
--- a/pkg/lokiunifi/report_anomaly.go
+++ b/pkg/lokiunifi/report_anomaly.go
@@ -28,6 +28,7 @@ func (r *Report) Anomaly(event *unifi.Anomaly, logs *Logs) {
 		Entries: [][]string{{strconv.FormatInt(event.Datetime.UnixNano(), 10), string(msg)}},
 		Labels: CleanLabels(MergeLabels(map[string]string{
 			"application": "unifi_anomaly",
+			"job":         "unpoller",
 			"source":      event.SourceName,
 			"site_name":   event.SiteName,
 		}, r.ExtraLabels)),
diff --git a/pkg/lokiunifi/report_event.go b/pkg/lokiunifi/report_event.go
index e7680fef..5a7eb58b 100644
--- a/pkg/lokiunifi/report_event.go
+++ b/pkg/lokiunifi/report_event.go
@@ -29,6 +29,7 @@ func (r *Report) Event(event *unifi.Event, logs *Logs) {
 		Entries: [][]string{{strconv.FormatInt(event.Datetime.UnixNano(), 10), string(msg)}},
 		Labels: CleanLabels(MergeLabels(map[string]string{
 			"application": "unifi_event",
+			"job":         "unpoller",
 			"site_name":   event.SiteName,
 			"source":      event.SourceName,
 		}, r.ExtraLabels)),
@@ -54,6 +55,7 @@ func (r *Report) SystemLogEvent(event *unifi.SystemLogEntry, logs *Logs) {
 		Entries: [][]string{{strconv.FormatInt(event.Datetime().UnixNano(), 10), string(msg)}},
 		Labels: CleanLabels(MergeLabels(map[string]string{
 			"application": "unifi_system_log",
+			"job":         "unpoller",
 			"site_name":   event.SiteName,
 			"source":      event.SourceName,
 			"category":    event.Category,
diff --git a/pkg/lokiunifi/report_ids.go b/pkg/lokiunifi/report_ids.go
index 735951c5..74fab782 100644
--- a/pkg/lokiunifi/report_ids.go
+++ b/pkg/lokiunifi/report_ids.go
@@ -27,9 +27,12 @@ func (r *Report) IDs(event *unifi.IDS, logs *Logs) {
 	logs.Streams = append(logs.Streams, LogStream{
 		Entries: [][]string{{strconv.FormatInt(event.Datetime.UnixNano(), 10), string(msg)}},
 		Labels: CleanLabels(MergeLabels(map[string]string{
-			"application": "unifi_ids",
-			"source":      event.SourceName,
-			"site_name":   event.SiteName,
+			"application":        "unifi_ids",
+			"job":                "unpoller",
+			"source":             event.SourceName,
+			"site_name":          event.SiteName,
+			"event_type":         event.EventType,
+			"inner_alert_action": event.InnerAlertAction,
 		}, r.ExtraLabels)),
 	})
 }
diff --git a/pkg/lokiunifi/report_protect.go b/pkg/lokiunifi/report_protect.go
index 7a928e64..9334c48d 100644
--- a/pkg/lokiunifi/report_protect.go
+++ b/pkg/lokiunifi/report_protect.go
@@ -36,6 +36,7 @@ func (r *Report) ProtectLogEvent(event *unifi.ProtectLogEntry, logs *Logs) {
 		Entries: [][]string{{strconv.FormatInt(event.Datetime().UnixNano(), 10), string(msg)}},
 		Labels: CleanLabels(MergeLabels(map[string]string{
 			"application": "unifi_protect_log",
+			"job":         "unpoller",
 			"source":      event.SourceName,
 			"event_type":  event.GetEventType(),
 			"category":    event.GetCategory(),
@@ -59,6 +60,7 @@ func (r *Report) ProtectLogEvent(event *unifi.ProtectLogEntry, logs *Logs) {
 			Entries: [][]string{{strconv.FormatInt(event.Datetime().UnixNano()+1, 10), string(thumbnailJSON)}},
 			Labels: CleanLabels(MergeLabels(map[string]string{
 				"application": "unifi_protect_thumbnail",
+				"job":         "unpoller",
 				"source":      event.SourceName,
 				"event_id":    event.ID,
 				"camera":      event.Camera,