diff --git a/promtail/promtail-config.yaml b/promtail/promtail-config.yaml
index d6b70c16..865203f7 100644
--- a/promtail/promtail-config.yaml
+++ b/promtail/promtail-config.yaml
@@ -41,16 +41,10 @@ scrape_configs:
           action: drop
           drop_counter_reason: promtail_noisy_error
       - match:
-          selector: '{promtail-audit-logs="true"}'
+          selector: '{app_kubernetes_io_name="falco"}'
           stages:
-            - client:
-                url: http://loki-audits.sys-log.svc.cluster.aws:3100/loki/api/v1/push
-                external_labels:
-                  cloud_provider: ${CLOUD_PROVIDER}
-                  uw_environment: ${UW_ENVIRONMENT}
-                  kubernetes_cluster: ${KUBERNETES_CLUSTER}
-                  cluster: ${KUBERNETES_CLUSTER}
-                  provider: ${CLOUD_PROVIDER}
+            - output:
+                source: http://loki-audits.sys-log.svc.cluster.aws:3100/loki/api/v1/push
       - limit:
           rate: 10
           burst: 10