Loki push (Promtail, Alloy, Grafana Agent, Docker driver)

Point a Loki client at the gateway. Needs an ingestion key with ingest:logs, sent as Authorization: Bearer <key> (or Basic auth with the key as the password, or x-watchtower-key).

POST /loki/api/v1/push

Both the JSON body and the snappy protobuf body (logproto.PushRequest) are accepted. Stream labels become resource attributes (service_name, app or job becomes service.name), the line is the body, structured metadata becomes log attributes. A request holds at most 100,000 entries and 1,024 labels; larger ones get 413.

Alloy example, with WT_GATEWAY and WT_INGEST_KEY in the environment:

loki.write "watchtower" {
  endpoint {
    url          = "https://" + sys.env("WT_GATEWAY") + "/loki/api/v1/push"
    bearer_token = sys.env("WT_INGEST_KEY")
  }
}

Delivery is at-least-once: clients retry on a non-2xx answer, so a lost acknowledgement can duplicate lines. Do not set wt.* labels; the gateway deletes them.

Status: structure-checked, not yet run against a real Loki client.