Skip to content

Commit

Permalink
Update logql.md
Browse files Browse the repository at this point in the history
  • Loading branch information
lmangani authored Nov 10, 2023
1 parent 87a9f1a commit c1a7ec3
Showing 1 changed file with 16 additions and 9 deletions.
25 changes: 16 additions & 9 deletions docs/guide/logql.md
Original file line number Diff line number Diff line change
Expand Up @@ -140,12 +140,14 @@ Return lines including the text "status 403" or "status 503" using regex

We can use operations on both the log **stream selectors** and **filter expressions** to refine them.

## ** Format **
## ** Filter Expressions **

### Parser Expression
Parser expression can parse and extract labels from the log content. Those extracted labels can then be used for filtering using label filter expressions or for metric aggregations.
<!-- tabs:start -->

### ** Parser Expression **
Parser expressions can parse and extract labels from the log content. Those extracted labels can then be used for filtering using label filter expressions or for metric aggregations.

#### json
#### `json`
The json parser operates in two modes:

* without parameters:
Expand All @@ -156,16 +158,18 @@ The json parser operates in two modes:
* Using `| json label="expression"` in your pipeline will extract only the specified json fields to labels.
* ```{job="0.6611336793589486_json"} | json my_field="json_field"```

#### logfmt
#### `logfmt`
The logfmt parser extracts any key=value pairs from the processed logs.

#### regexp
#### `regexp`
The regexp parser operates against log string and requires named groups for matching.

Example: extract a new label named `token` from a string ie: `YYYY-MM-DDT00:00:00Z ... Reserving 1.1Mb of memory`
Example: extract a new label named `token` from a string ie:
```YYYY-MM-DDT00:00:00Z ... Reserving 1.1Mb of memory```

* ```{type="clickhouse"} |~"Reserving" | regexp "Reserving (?<token>\\d+.\\d+)"```

#### Line Format
#### ** Line Format **
Line Format expression allows the re-formatting of parts of a log line. It can extract items from parsed json.

To extract a *parameter* we use "{{}}" to surround it and extract it as the displayed log line as a result. Any thing can be added to this line format, to allow for additional notes or formatting.
Expand All @@ -176,7 +180,7 @@ To extract a *parameter* we use "{{}}" to surround it and extract it as the disp

Creates new log lines of the string "My field: VALUE"

#### Label Filter Expression
#### ** Label Filter Expression **
Label filter expression allows filtering log line using their original and extracted labels. It can contain multiple predicates.

A predicate contains a *label identifier*, an *operation* and a *value* to compare the label with.
Expand All @@ -186,6 +190,9 @@ Label filters work like label matchers and use the same operations (`=`,`!=`,`=~
```
{job="0.6611336793589486_json"} | json | my_field="VALUE"
```
<!-- tabs:end -->

<!-- end of subtab -->

<!-- tabs:end -->

Expand Down

0 comments on commit c1a7ec3

Please sign in to comment.