Skip to content

Commit

Permalink
Update logql.md
Browse files Browse the repository at this point in the history
  • Loading branch information
lmangani authored Nov 10, 2023
1 parent 435479c commit 24b8a44
Showing 1 changed file with 9 additions and 4 deletions.
13 changes: 9 additions & 4 deletions docs/guide/logql.md
Original file line number Diff line number Diff line change
Expand Up @@ -145,9 +145,11 @@ We can use operations on both the log **stream selectors** and **filter expressi
<!-- tabs:start -->

### ** Parser Expression **
Parser expressions can parse and extract labels from the log content. Those extracted labels can then be used for filtering using label filter expressions or for metric aggregations.
Parser expressions can parse and extract labels from the log content. Those extracted labels can then be used for filtering using label filter expressions or for metric aggregations without bloating cardinality.

### json
<!-- tabs:start -->

### ** json **
The json parser operates in two modes:

* without parameters:
Expand All @@ -158,21 +160,24 @@ The json parser operates in two modes:
* Using `| json label="expression"` in your pipeline will extract only the specified json fields to labels.
* ```{job="0.6611336793589486_json"} | json my_field="json_field"```

### logfmt
### ** logfmt **
The logfmt parser extracts any `key=value` pairs from the processed logs.

```
YYYY-MM-DDT00:00:00Z ... name=qryn value=123 something=else
```

### regexp
### ** regexp **
The regexp parser operates against log string and requires named groups for matching.

Example: extract a new label named `token` from a string ie:
```YYYY-MM-DDT00:00:00Z ... Reserving 1.1Mb of memory```

* ```{type="clickhouse"} |~"Reserving" | regexp "Reserving (?<token>\\d+.\\d+)"```

<!-- tabs:end -->


#### ** Line Format **
Line Format expression allows the re-formatting of parts of a log line. It can extract items from parsed json.

Expand Down

0 comments on commit 24b8a44

Please sign in to comment.