LogQL: selectors, filters and | json

Audience

beginner who has read lessons 01 and 02 of this module

Duration

45 to 60 min

Module

5/7

Target skill

write a LogQL query in two parts (selector then pipeline), read fields of a JSON line with | json, filter on a field, reformat the line, and recognise the four error messages Loki returns most often

In one picture

A LogQL query reads like a sentence in two pieces separated by vertical bars. The first piece, between braces, says which shelf to go to: {service="api"}. Loki uses it to choose streams, without reading a single line. Everything that comes after, behind |, says what to do with each line once the shelf is open: keep it or not (|= "500"), open it to read its fields (| json), keep it according to a field (| duree_ms > 500), rewrite it (| line_format). That second piece is called the pipeline, and it runs left to right, line by line, exactly like Unix pipes.