I have a docker compose setup, which runs multiple microservices and does observability stuff with grafana stack( loki for logs, prometheus for metrics and tempo for tracing). All of my microservices write logs to a shared docker volume, with in a folder which is named after the microservice name. I have a prom-tail container which will sync logs to loki using a single job.

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: log_collector
    static_configs:
      - targets:
          - localhost
        labels:
          job: log_collector
          __path__: /app_logs/*/*.log
    relabel_configs:
      - source_labels: [__path__]
        target_label: service
        regex: /app_logs/([^/]+)/[^/]+\.log
        replacement: $1

Now since multiple services are writing to the app_logs directory, I want to identify the service name with the immediate directory in app_logs. I am little weak on regex, instead of getting the service populated with the actual service name, I am getting '*' for the service label.

Any help on this would be greatly appreciated. Thanks in advance.