Loki (Log Aggregation) Cheat Sheet

# Stream selector - filter by labels{app="checkout", env="prod"}# Line filter - substring match{app="checkout"} |= "error"# Negative line filter{app="checkout"} != "healthcheck"# Regex line filter{app="checkout"} |~ "timeout|refused"# Parse JSON logs into labels{app="checkout"} | json# Filter on a parsed field{app="checkout"} | json | status_code >= 500# logfmt parsing{app="checkout"} | logfmt | duration > 500ms

# Log lines per second matching a filtersum(rate({app="checkout"} |= "error" [5m]))# Rate grouped by labelsum by (pod) (rate({app="checkout"}[5m]))# Count over timecount_over_time({app="checkout"} |= "panic" [1h])# Extract a numeric field and compute quantile latencyquantile_over_time(0.99,  {app="checkout"} | json | unwrap duration [5m]) by (route)# Bytes ingested per streamsum(bytes_rate({app="checkout"}[5m])) by (pod)

server:  http_listen_port: 9080clients:  - url: http://loki:3100/loki/api/v1/pushscrape_configs:  - job_name: kubernetes-pods    kubernetes_sd_configs:      - role: pod    pipeline_stages:      - docker: {}      - json:          expressions:            level: level            msg: message      - labels:          level:    relabel_configs:      - source_labels: [__meta_kubernetes_pod_label_app]        target_label: app      - source_labels: [__meta_kubernetes_namespace]        target_label: namespace