Usage of /usr/bin/prom-label-proxy:
  -enable-label-apis
    	When specified proxy allows to inject label to label APIs like /api/v1/labels and /api/v1/label/<name>/values. NOTE: Enable with care because filtering by matcher is not implemented in older versions of Prometheus (>= v2.24.0 required) and Thanos (>= v0.18.0 required, >= v0.23.0 recommended). If enabled and any labels endpoint does not support selectors, the injected matcher will have no effect.
  -enable-label-matchers-for-rules-api
    	When true, the proxy uses label matchers when querying the /api/v1/rules endpoint. NOTE: Enable with care because filtering by label matcher is not implemented in older versions of Prometheus (>= 2.54.0 required) and Thanos (>= v0.25.0 required). If not implemented by upstream, the response will not be filtered accordingly.
  -enable-promql-binop-fill-modifiers
    	When true, the proxy supports binary operation fill modifiers in PromQL expressions.
  -enable-promql-duration-expression-parsing
    	When true, the proxy supports arithmetic for durations in PromQL expressions.
  -enable-promql-experimental-functions
    	When true, the proxy supports experimental functions in PromQL expressions.
  -enable-promql-extended-range-selectors
    	When true, the proxy supports extended range selectors in PromQL expressions.
  -error-on-replace
    	When specified, the proxy will return HTTP status code 400 if the query already contains a label matcher that differs from the one the proxy would inject.
  -header-name string
    	Name of the HTTP header name that contains the tenant value. At most one of -query-param, -header-name and -label-value should be given.
  -header-uses-list-syntax
    	When specified, the header line value will be parsed as a comma-separated list. This allows a single tenant header line to specify multiple tenant names.
  -http-timeout duration
    	Timeout for proxied HTTP requests. If zero, no timeout is applied.
  -insecure-listen-address string
    	The address the prom-label-proxy HTTP server should listen on.
  -insecure-skip-verify
    	When specified, the proxy will bypass validation of the server's TLS/SSL certificate.
  -internal-listen-address string
    	The address the internal prom-label-proxy HTTP server should listen on to expose metrics about itself.
  -label string
    	The label name to enforce in all proxied PromQL queries.
  -label-value value
    	A fixed label value to enforce in all proxied PromQL queries. At most one of -query-param, -header-name and -label-value should be given. It can be repeated in which case the proxy will enforce the union of values.
  -log.format value
    	Output format of log messages. One of: [logfmt, json] (default logfmt)
  -log.level value
    	Only log messages with the given severity or above. One of: [debug, info, warn, error]
  -query-param string
    	Name of the HTTP parameter that contains the tenant value. At most one of -query-param, -header-name and -label-value should be given. If the flag isn't defined and neither -header-name nor -label-value is set, it will default to the value of the -label flag.
  -query-param-only
    	Use only URL query values for the tenant parameter; reject non-empty POST form values (HTTP 400). Effective only with -query-param (explicit or defaulted from -label); otherwise ignored. For URL-only authz proxies (see README).
  -regex-match
    	When specified, the tenant name is treated as a regular expression. In this case, only one tenant name should be provided.
  -rewrite-host-header-to string
    	Rewrite the Host header to the supplied value when proxying requests to the upstream URL. Useful when the upstream is behind an ingress that routes based on the Host header.
  -rules-with-active-alerts
    	When true, the proxy will return alerting rules with active alerts matching the tenant label even when the tenant label isn't present in the rule's labels.
  -unsafe-passthrough-paths string
    	Comma delimited allow list of exact HTTP path segments that should be allowed to hit upstream URL without any enforcement. This option is checked after Prometheus APIs, you cannot override enforced API endpoints to be not enforced with this option. Use carefully as it can easily cause a data leak if the provided path is an important API (like /api/v1/configuration) which isn't enforced by prom-label-proxy. NOTE: "all" matching paths like "/" or "" and regex are not allowed.
  -upstream string
    	The upstream URL to proxy to.
  -upstream-ca-cert string
    	The upstream ca certificate file.
  -upstream-client-cert string
    	The client certificate file to present for mutual TLS with the upstream. Requires -upstream-client-key.
  -upstream-client-key string
    	The client key file to present for mutual TLS with the upstream. Requires -upstream-client-cert.
  -upstream-server-name string
    	The server name used to verify the upstream's TLS certificate. Useful when the upstream URL host does not match the certificate.

panic calling String method on zero promslog.Level for flag log.level: runtime error: invalid memory address or nil pointer dereference