11

I'm trying to test our Loki log data source. From the Queries I've been executing nothing is returned.

It's possible that the logs are in a different format to what I'm expecting, or that no Logs are ingested by Loki, and my pipeline is broken somewhere.

Is there a Loki query that returns all the logs?

I've looked through documentation, and so far, I haven't found any such Loki query. Any other queries to help debug would be appreciated!

fuzzi
  • 1,967
  • 9
  • 46
  • 90

2 Answers2

11

{host=~ ".*"} doesn't work for me. Use {host=~ ".+"} That should work always.

logi-kal
  • 7,107
  • 6
  • 31
  • 43
SmarD
  • 111
  • 1
  • 2
  • Note that Loki limits the number of returned log lines per query to 5000 - see [these docs](https://grafana.com/docs/loki/v2.8.x/tools/logcli/#batched-queries). It may prevent from returning all the results for queries matching more than 5k log lines. If you need returning all the matching log lines in streaming manner, then take a look [at this system](https://docs.victoriametrics.com/VictoriaLogs/querying/#command-line). – valyala Jul 08 '23 at 06:47
6

You can use a match-all regex together with a stream you have for all your logs.

For example if you collect a stream named host for all your incoming logs you'd query for:

{host=~ ".*"}

You should note that at present a stream selector is always required for querying logs.

Georgi
  • 734
  • 6
  • 12
  • 3
    Grafana v9.3.6 parser complains: `parse error : queries require at least one regexp or equality matcher that does not have an empty-compatible value. For instance, app=~".*" does not meet this requirement, but app=~".+" will` – jleach Feb 11 '23 at 10:02