Docs feedback: clarify that multiple keep rules are sequential (AND), not OR #3877
Description
URL
https://github.com/grafana/alloy/blob/main/docs/sources/tutorials/logs-and-relabeling-basics.md
Feedback
What happened
I tried onboarding pods via two separate keep rules (one for annotation, one for label) and was surprised that pods matching only the second rule still got dropped—because the first keep rule filters them out early.
Why it matters
This sequential (“in order”) behavior isn’t obvious, and it cost me hours of debugging. A brief note in the relabeling docs would prevent others from falling into the same trap.
Suggested doc change
In docs/sources/tutorials/logs-and-relabeling-basics.md under the Keep section, find the line:
“This example has one rule block, but you can have as many as you want. Each rule block is applied in order.”
Immediately after it, add:
Note: Multiple
keeprules are applied sequentially. If a target fails the firstkeep, it’s dropped immediately—so two separatekeeprules act like a logical AND. To implement OR logic across multiple criteria, combine them in one rule using multiplesource_labelsand a compound regex.
Example (OR in one rule):rule { source_labels = ["__meta_kubernetes_pod_annotation_A", "__meta_kubernetes_pod_label_B"] regex = "(true;.*|.*;true)" action = "keep" }