Setting up Grafana Alloy on Windows – Metrics and Event Logs for the Homelab

by

My homelab observability stack has been running for a while – Loki for logs, Mimir for metrics – but my gaming PC HEYDIELES wasn’t wired into it yet. That changes now. With Grafana Alloy, setting up Windows monitoring turns out to be surprisingly clean.

What gets collected

  • System metrics (CPU, RAM, disks, network, services, processes, temperatures) → Mimir
  • Windows Event Logs (Application, System, Security) → Loki

If you know Linux’s journald: the Windows equivalent is the three Event Log channels. Together they cover roughly the same ground that the systemd journal does on a Linux host.

The config.alloy

The config file lives at C:\Program Files\GrafanaLabs\Alloy\config.alloy. Here’s the full content:

// ============================================================
//  Grafana Alloy — config.alloy
//  Host   : HEYDIELES (Windows)
//  Metrics: prometheus.exporter.windows → Mimir
//  Logs   : Windows Event Logs (App / System / Security) → Loki
// ============================================================


// ------------------------------------------------------------
// 1. Windows Metrics Exporter
// ------------------------------------------------------------
prometheus.exporter.windows "default" {
  enabled_collectors = [
    "cpu",
    "cs",           // computer system (hardware info)
    "logical_disk",
    "memory",
    "net",
    "os",
    "process",
    "service",
    "system",
    "thermalzone",
  ]
}


// ------------------------------------------------------------
// 2. Scrape the Windows exporter
// ------------------------------------------------------------
prometheus.scrape "windows" {
  targets         = prometheus.exporter.windows.default.targets
  forward_to      = [prometheus.remote_write.mimir.receiver]
  scrape_interval = "60s"
  job_name        = "windows"
}


// ------------------------------------------------------------
// 3. Remote Write → Mimir
// ------------------------------------------------------------
prometheus.remote_write "mimir" {
  endpoint {
    url = "http://10.0.1.65:9090/api/v1/write"
  }

  external_labels = {
    host = "HEYDIELES",
  }
}


// ------------------------------------------------------------
// 4. Windows Event Logs → Loki
// ------------------------------------------------------------
loki.source.windowsevent "application" {
  eventlog_name          = "Application"
  use_incoming_timestamp = true
  forward_to             = [loki.write.loki.receiver]

  labels = {
    job     = "windows_events",
    host    = "HEYDIELES",
    channel = "Application",
  }
}

loki.source.windowsevent "system" {
  eventlog_name          = "System"
  use_incoming_timestamp = true
  forward_to             = [loki.write.loki.receiver]

  labels = {
    job     = "windows_events",
    host    = "HEYDIELES",
    channel = "System",
  }
}

loki.source.windowsevent "security" {
  eventlog_name          = "Security"
  use_incoming_timestamp = true
  forward_to             = [loki.write.loki.receiver]

  labels = {
    job     = "windows_events",
    host    = "HEYDIELES",
    channel = "Security",
  }
}


// ------------------------------------------------------------
// 5. Loki Write
// ------------------------------------------------------------
loki.write "loki" {
  endpoint {
    url = "http://10.0.0.101:3100/loki/api/v1/push"
  }

  external_labels = {
    host = "HEYDIELES",
  }
}

Note: Security Event Log permissions

The Security channel is access-restricted. For Alloy to read it, the service must either run as Local System (the default Windows installation does this) or the service account must be granted the “Manage auditing and security log” user right via secpol.msc.

Restarting the service

After saving the config, restart the service once:

Restart-Service GrafanaAlloy

You can tail the log output directly in PowerShell:

Get-Content "C:\ProgramData\GrafanaLabs\Alloy\logs\alloy.log" -Wait

Which Grafana dashboard?

For metrics I recommend the Windows Exporter Dashboard 2025 (ID 24390). It’s the most up-to-date community dashboard, supports windows_exporter 0.31+, and has clean visualisations for CPU, RAM, disk, and network.

If you also want a live view of all Windows service states, Windows Exporter 2024 – With Services (ID 22321) is worth adding.

To import: Dashboards → Import → enter the ID → select your Mimir datasource.

Combining metrics and logs

There’s no ready-made all-in-one dashboard that merges Windows metrics with Event Logs – but you can build one quickly: import dashboard 24390 and add a Logs panel at the bottom pointing at Loki with this query:

{host="HEYDIELES", job="windows_events"}

That gives you CPU spikes and the corresponding Event Log entries on a single screen – exactly the approach Grafana Cloud’s official Windows integration uses.

Wrap-up

Grafana Alloy makes Windows monitoring considerably more pleasant than older solutions. The config is declarative, easy to read, and straightforward to extend – for example with the scheduled_task or tcp collectors, or GPU metrics via nvidia_smi. For a homelab setup that already runs Loki and Mimir, the overhead is minimal.

Leave a comment