From 24b8a44c3e1b8b4b8300e3b72c4401e2cabb42f3 Mon Sep 17 00:00:00 2001 From: Lorenzo Mangani Date: Fri, 10 Nov 2023 18:56:57 +0100 Subject: [PATCH] Update logql.md --- docs/guide/logql.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docs/guide/logql.md b/docs/guide/logql.md index 1d0aa85..55445d4 100644 --- a/docs/guide/logql.md +++ b/docs/guide/logql.md @@ -145,9 +145,11 @@ We can use operations on both the log **stream selectors** and **filter expressi ### ** Parser Expression ** -Parser expressions can parse and extract labels from the log content. Those extracted labels can then be used for filtering using label filter expressions or for metric aggregations. +Parser expressions can parse and extract labels from the log content. Those extracted labels can then be used for filtering using label filter expressions or for metric aggregations without bloating cardinality. -### json + + +### ** json ** The json parser operates in two modes: * without parameters: @@ -158,14 +160,14 @@ The json parser operates in two modes: * Using `| json label="expression"` in your pipeline will extract only the specified json fields to labels. * ```{job="0.6611336793589486_json"} | json my_field="json_field"``` -### logfmt +### ** logfmt ** The logfmt parser extracts any `key=value` pairs from the processed logs. ``` YYYY-MM-DDT00:00:00Z ... name=qryn value=123 something=else ``` -### regexp +### ** regexp ** The regexp parser operates against log string and requires named groups for matching. Example: extract a new label named `token` from a string ie: @@ -173,6 +175,9 @@ Example: extract a new label named `token` from a string ie: * ```{type="clickhouse"} |~"Reserving" | regexp "Reserving (?\\d+.\\d+)"``` + + + #### ** Line Format ** Line Format expression allows the re-formatting of parts of a log line. It can extract items from parsed json.