Stack Overflow
Stack Overflow

Questions tagged [logql]

LogQL is a query language for Grafana Loki, similar to PromQL for Prometheus. This tag should be added to questions about crafting query to Grafana Loki. Consider also adding the `grafana-loki` tag.

56 questions
15
votes
2 answers

Loki json logs filter by detected fields from grafana

I am sending json logs to loki and visualizing in grafana. Initially, my logs looked like as following. { "log":…
Timam
  • 378
  • 1
  • 2
  • 8
12
votes
0 answers

Grafana Loki LogQL: How to parse log lines with different log formats?

We have different type of logs for one and the same application. Some are coming from our application which logs in a JSON format and others are different types of log messages. For example these 3 log lines: "{\"written_at\":…
Spenhouet
  • 6,556
  • 12
  • 51
  • 76
9
votes
1 answer

Grafana Loki total number of a specific log message

I am using Grafana Loki and I need to calculate the total number of a certain log message for a specific time interval. For example, I need the total number of log message "some-text" in the period from 12:00:00 to 14:00:00. I just found the…
bennex
  • 437
  • 2
  • 5
  • 12
8
votes
2 answers

Grafana Loki LogQL bar gauge order by total

I am using Grafana and Loki to analyze logs from my application, and have used the Bar Gauge in a few places already. This is my query: sum(count_over_time({namespace=~"$namespace", job=~"$namespace-logs"} |= "KPIExecuted" [$__interval])) by…
Ricardo Cardona Ramirez
  • 570
  • 1
  • 5
  • 22
6
votes
1 answer

Grafana - Is it possible to use variables in Loki-based dashboard query?

I am working on a Loki-based Dashboard on Grafana. I have one panel for searching text in the Loki trace logs, the current query is like: {job="abc-service"} |~ "searchTrace" |json |line_format "{if .trace_message}} Message: \t{{.trace_message}}…
Ken Tsoi
  • 1,195
  • 1
  • 17
  • 37
6
votes
2 answers

Regexp JSON filtering in LogQL

I'd like to translate Kibana query like to following to LogQL: host:("test1-myservice-*") AND level:ERROR AND NOT logger_name:"com.example.ExampleClass" AND _exists_:stack_trace AND NOT stack_trace:( "interrupted" OR "Read timed out" …
palacsint
  • 28,416
  • 10
  • 82
  • 109
4
votes
1 answer

Grafana Loki Parsing and Aggregating over Labels - LogQL

I have logs coming from repositories into grafana (loki). I am trying to get the number of repositories (that have the msg="Repository finished") for a given duration of, say 6h" I used these queries but they don't deliver any results sum by…
QBits
  • 121
  • 1
  • 11
4
votes
1 answer

How to search multiple strings in same entry in Loki

Im trying to filter out log entries which matche two strings given. The log entries are not json compatible so it cannot be parsed to json. Example log entry looks like [INFO ] (-Worker-10) com.xx.yy.logging.UserLog Ys5morE1Kd8AkGxysKiNQgAAAsY -…
Dilantha
  • 1,552
  • 2
  • 30
  • 46
3
votes
0 answers

Loki LogQL corellate maillogs

please assist me on parsing mail logs using Loki & Grafana :) My logging server collects maillog files from Linux server, and I want to use Loki to check status (sent, deferred, etc) of messages from specific user. The problem is that mail logs are…
Dmitri
  • 111
  • 1
  • 7
3
votes
0 answers

Advanced Loki searches from inside json map/list

I have a WAF log like { "terminatingRuleId": "Default_Action", "action": "ALLOW", "nonTerminatingMatchingRules": [{ "ruleId": "AWS-AWSManagedRulesSQLiRuleSet", "action": "COUNT", "ruleMatchDetails": [{ …
Mike
  • 7,769
  • 13
  • 57
  • 81
2
votes
0 answers

How can I parse a substring from a json log

Would be grateful if someone can point me out to how I can parse a substring. I have this query: {app="main", event="log"} | tags =~ ".*error.*" | tags !~ ".*connection.*" != "ECONNRESET" | json message="data.message" Instead of having the entire…
user2028882
  • 21
  • 1
2
votes
0 answers

How should we resolve SampleExtraction Error in LogQL? We want to find maximum value of field after grouping the data in LogQL

We already have info on the count of requests which has response time greater than 3000ms. Now we have to find out the max response time from those requests. Example: |**Request**| **Count**| |Req1 | 5 | |Req2 | 3 | So we…
ShraddhaJ
  • 201
  • 1
  • 14
2
votes
1 answer

Average response time by path in loki logs

I have stream of http logs json via Loki that look like: 2022-11-30 16:18:46 {"message":{"duration":"8.37ms","env":"dev","path":"/rest/path1","status":200}} 2022-11-30 16:18:46…
Saireddy
  • 29
  • 3
2
votes
1 answer

LogQL : How to get the last values?

I am parsing access logs from Squid (proxy) with Loki and Grafana. I am trying to do something simple : display top 10 requested domains (or IP) in the last 24h. To do so, I created a Loki label which extract the domain from the log line in the Loki…
Mdstn
  • 31
  • 3
2
votes
0 answers

How to change string to int in logql grafana

|label_format num={{102}} |label_format num2 = {{90}} | label_format ans= {{if gt .num .num2 }}good {{else}} bad {{end}} | line_format {{.ans}} I have created two labels and assigned values to them.When I perform the gt operation the output shows…
niv
  • 21
  • 1
1
2 3 4