Вопрос решил так:
* поставил promtail на vm
* написал правило
scrape_configs:
- file_sd_configs:
- files:
- /etc/promtail/file_sd/*.yml
- /etc/promtail/file_sd/*.yaml
- /etc/promtail/file_sd/*.json
job_name: file_sd
- job_name: journal
journal:
labels:
hostname: ''
job: systemd-journal
max_age: 12h
pipeline_stages:
- regex:
expression: .*(?P<drop_key>oom-kill).*
- labels:
drop_key: null
- match:
action: drop
selector: '{drop_key!="oom-kill"}'
relabel_configs:
- source_labels:
- _journal_systemd_unit
target_label: unit