Observability

LogQL Query Builder

Build a Loki query with the stream selector, line filters and parser in the order that keeps it cheap.

1. Stream selector

These labels are indexed, and they are the only part of the query that reduces how much data Loki reads. Everything after the pipe filters what has already been fetched.

2. Line filters

Applied before parsing, which makes them by far the cheapest stage. Put one here and the parser only ever sees candidate lines.

3. Parser

Flattens nested objects with underscores

4. Label filters

These match on labels the parser produced, so a filter on a field with no parser ahead of it matches nothing at all rather than erroring.

5. Turn it into a metric

Returns lines

Query
log query
{namespace="production", app="api"} |= "error" | json | level = "error"

With logcli

logcli query --since=1h '{namespace="production", app="api"} |= "error" | json | level = "error"'
  • InfoStream selector labels are indexed; everything after the pipe is not. Narrowing the selector is what makes a query fast — adding label filters does not.
  • Low| json flattens nested objects with underscores, so {"a":{"b":1}} becomes the label a_b. It also drops lines that are not valid JSON.

Common queries