Drop stage with multiple sources results in config unmarshall error

[puppetninja]

Describe the bug
Config drop stage with list of sources

To Reproduce
Steps to reproduce the behavior:

1. Config Promtail with a drop stage with multiple sources
2. Started Promtail (2.8.3) to tail '...'

Expected behavior
We followed the drop stage with multiple sources link here
https://grafana.com/docs/loki/v2.8.x/clients/promtail/stages/drop/
And got the config unmarshall error, we can see the test for drop with multiple sources is not covered here
https://github.com/grafana/loki/blob/main/clients/pkg/logentry/stages/drop_test.go#L19

A possible reason could be due to this
https://medium.com/@kosiriki/accepting-both-string-and-array-for-single-yaml-key-in-golang-2e3d7143de8d

Environment:

• Infrastructure: Kubernetes
• Deployment tool: helm

Screenshots, Promtail config, or terminal output
If applicable, add any output to help explain your problem.

This is the snippet of the config

      - json:
          expressions:
            http_user_agent: http_user_agent
            status: status
      - drop:
          expression: .*traffic-manager.*;^(2|3|4)[0-9]{2}
          separator: ;
          source: 
             - "http_user_agent"
             - "status"

And this is the error we got:

failed to make file target manager: invalid drop stage config: drop stage source invalid type should be string or list of strings

[BlackSmith]

Any progress? The same error with Promtail (2.8.4) .

[rgroothuijsen]

The problem appears to be a type conversion error between the YAML configuration and the objects in code. source doesn't specify a type since it can be either a string or a list of strings, which unfortunately means that a list of strings gets parsed as an untyped list. This then causes the type check to fail here.

[galdor]

I can reproduce this bug on v2.9.2 (released on October 16th) while the patch was merged on Octobre 12th.

[ShadowySpirits]

I have the same problem in v2.9.3. Is there any update on this issue?

[longtomjr]

It looks like the fix will be released as part of v2.9.5. In the meantime, I am using this workaround that might be useful for others:

      # Workaround for https://github.com/grafana/loki/issues/10095
      # can be removed once we update to 2.9.5
      - template:
          source: merged_drop_string
          template: "{{.uri}};{{.remote_user}};{{.remote_addr}}"
      - drop:
          source: merged_drop_string
          expression: ...

Just list the extracted values in a template block with your preferred separator instead of on the source key, and then use the new template value instead. Can easily be changed once the fix have been released.