0

I've started shipping traefik access logs (in JSON) to Grafana Loki and wanted to visualize the top 3 ClientHosts. This is the LogQL I have written for this but it returns all ClientHosts for the selected time range instead of only the top 3. What am I missing?

topk(3, sum by (ClientHost)(count_over_time({filename="/var/log/traefik/access-json.log"}|json[5m])))
Philipp
  • 1,001
  • 3
  • 10
  • 10

1 Answers1

0

Are you using the "Explore" on Grafana? Do not forget to select the following option:

Query type = Instant
Marcelo Ávila de Oliveira
  • 19,950
  • 3
  • 39
  • 50
  • Hello, thanks for this answer - would you mind adding a quick explanation for the differences between instant vs. range query types? And if possible could you link to documentation? (I find it very difficult to find good grafana+loki+logql documentation myself!) – Gershom Maes Apr 08 '22 at 16:48
  • "Instant" will show only the last value of your query and "range" will show results for the entire time range. I think here you can find more detailed answers: https://stackoverflow.com/questions/51728031/what-does-the-instant-checkbox-in-grafana-graphs-based-on-prometheus-do – Marcelo Ávila de Oliveira Apr 08 '22 at 23:19