0

Loki Log click the log screenshot attached here i have get logs with this query

{namespace="health-helper-stg"} |json | line_format "{{.log}}"

There are multiple logs with different msg types from multiple apps.

So i need to get count of each msg type and its count in the grafana table. Because msg type is dynamically changing hardcore is not possible. for example:

msg "request completed"
msg     "ReceiveTokenService.getVoiceToken" 
msg     .............etc

So we want to get each msg types and count dynamically not always mention msg type in the query.

I'm using this query to get manually to build a table

sum by (app) (count_over_time({namespace="health-helper-stg"} |= "msg" |="ReceiveTokenService.getVoiceToken" [$__range]))

but need to get one by one for each msg type but it takes long time and values dynamically change when we update code.

markalex
  • 8,623
  • 2
  • 7
  • 32
Illthizam Nazar
  • 1
  • 2

2 Answers2

0
sum by (app, msg) (count_over_time({namespace="health-helper-stg"} | json | line_format "{{.log }}" | json | __error__!="JSONParserErr" [$__range] ))

here you can see sum by use for getting label (app and msg) so these values are together. count_over_time is provide specific condition within the function get count for time range. hence json use for change log style to readable contents. so i want to make "{{.log }}" to json format hence i took msg as labels so i add to sum by function. so it get all types of msg type and it counts in table . so i can select how many count for each msg type.

Illthizam Nazar
  • 1
  • 2
0

your answer is right . However, you could simplify it to extract nested json field in 1 step. here is an example how to extract nested field (LogQL Analyzer) enter image description here

So, if we apply it to your query it will be :

sum by (app, msg) (count_over_time({namespace="health-helper-stg"} | json app="app",msg="log.msg" | __error__!="JSONParserErr" [$__range] ))
Vladyslav Diachenko
  • 665
  • 5
  • 9