Loki json logs filter by detected fields from grafana

Question

I am sending json logs to loki and visualizing in grafana. Initially, my logs looked like as following.

  {   
     "log": "{\"additionalDetails\":{\"body\":{},\"ip\":\"::ffff:1.1.1.1\",\"params\":{},\"query\":{},\"responseTime\":0,\"userAgent\":\"ELB-HealthChecker/2.0\"},\"context\":\"http\",\"endpoint\":\"/healthz\",\"level\":\"info\",\"message\":\"[::ffff:1.1.1.1] HTTP/1.1 GET 200 /healthz 0ms\",\"requestId\":\"9fde4910-86cd-11ec-a1c5-cd8277a61e4a\",\"statusCode\":200}\n",   
     "stream": "stdout",   
     "time": "2022-02-05T21:49:58.178290044Z" 
  }

To make it more usable, I am using following query.

{app="awesome-loki-logs-with-grafana"} | json | line_format "{{.log}}"

And the results are really good. It automaticaly detects fileds as following.

How can I filter by statusCode, which is already being detected by grafana?

@MarceloÁviladeOliveira, Yes I accept the answer. It worked for me. — Timam, May 30 '22 at 15:06
@MarceloÁviladeOliveira you have to hit the check next to the answer to accept it. Saying "I accept the answer" in a comment is not sufficient. — Travis Bear, Oct 31 '22 at 21:47
Done! Appreciate your help. Thanks a ton. @MarceloÁviladeOliveira — Timam, Nov 01 '22 at 03:59
No @Timam you clicked on the "up arrow" and, this way, you have signaled that "the answer is useful". To accept the answer, you have to click on the "checkmark" next to the arrows. — Marcelo Ávila de Oliveira, Nov 01 '22 at 15:09

Marcelo Ávila de Oliveira · Accepted Answer · 2023-04-12T21:08:29.547

13

You can create a "status" custom variable with values like 200, 401, 403, 404, etc, and use the variable in the LogQL, like in the following example:

{app="awesome-loki-logs-with-grafana"} | json | statusCode=$status

edited Apr 12 '23 at 21:08

answered Feb 06 '22 at 00:13

Marcelo Ávila de Oliveira

19,950
3
39
50

I think it should be = instead of ==. – Der_Meister Apr 12 '23 at 17:41

score 2 · Answer 2 · answered Jun 08 '22 at 09:45

2

The easiest way is to create a label from the detected field so you can filter with the values you want:

{app="awesome-loki-logs-with-grafana"} | json statusCode="statusCode" | statusCode == $MY_FILTER_VALUE

For more information check grafana official documentation.

answered Jun 08 '22 at 09:45

Cristu Naranjo

93
7

I think it should be = instead of ==. – Der_Meister Apr 12 '23 at 17:41

Loki json logs filter by detected fields from grafana

2 Answers2