grafanagrafana-lokilogql

Loki json logs filter by detected fields from grafana

I am sending json logs to loki and visualizing in grafana. Initially, my logs looked like as following.

  {   
     "log": "{\"additionalDetails\":{\"body\":{},\"ip\":\"::ffff:1.1.1.1\",\"params\":{},\"query\":{},\"responseTime\":0,\"userAgent\":\"ELB-HealthChecker/2.0\"},\"context\":\"http\",\"endpoint\":\"/healthz\",\"level\":\"info\",\"message\":\"[::ffff:1.1.1.1] HTTP/1.1 GET 200 /healthz 0ms\",\"requestId\":\"9fde4910-86cd-11ec-a1c5-cd8277a61e4a\",\"statusCode\":200}\n",   
     "stream": "stdout",   
     "time": "2022-02-05T21:49:58.178290044Z" 
  }

To make it more usable, I am using following query.

{app="awesome-loki-logs-with-grafana"} | json | line_format "{{.log}}"

And the results are really good. It automaticaly detects fileds as following.

enter image description here

How can I filter by statusCode, which is already being detected by grafana?

Solution

  • You can create a "status" custom variable with values like 200, 401, 403, 404, etc, and use the variable in the LogQL, like in the following example:

    {app="awesome-loki-logs-with-grafana"} | json | statusCode=$status