Loki Cheat Sheet

Log aggregation at scale — LogQL stream selectors, line filters, parsers, range aggregations, and the logcli you run from a terminal.

Observability6 sections · 34 commands
⌘K

Stream Selectors

7
{app="nginx"}

All lines from a label value

{namespace="prod", tier="api"}

AND multiple labels

{app!="internal"}

Exclude a label value

{app=~"api|worker"}

Regex match label values

{namespace="prod"} | json

Select then parse JSON

logcli labels

Discover label names

logcli label values app

Values for a label

Line Filters

5
{app="api"} |= "error"

Lines containing 'error'

{app="api"} != "timeout"

Lines NOT containing 'timeout'

{app="api"} |~ "4[0-9]{2}"

Regex line match

{app="api"} !~ "5xx"

Exclude regex matches

{app="api"} |= "(" [!"debug"]

Multiple filters combined

Parsers

6
{app="api"} | json

Extract JSON fields as labels

{app="api"} | json level="lvl"

Rename a parsed label

{app="api"} | logfmt

Parse logfmt key=value lines

{app="api"} | regexp "(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)"

Extract via regexp

{app="api"} | json | level="error"

Filter on a parsed label

{app="api"} | line_format "{{.level}}: {{.msg}}"

Rewrite the output line

Aggregations & Rates

6
rate({app="api"}[5m])

Lines per second over 5m

count_over_time({app="api"}[1h])

Total lines in the window

sum by (level) (count_over_time({app="api"}[5m]))

Counts grouped by label

max by (pod) (rate({app="web"}[5m]))

Peak rate per pod

avg over (instance) (rate({app="db"}[10m]))

Average rate across instances

topk(3, rate({app="api"}[5m]))

Top 3 streams by rate

Time Ranges

4
{app="api"}[5m]

Logs from the last 5 minutes

{app="api"}[1h]

Last hour of logs

logcli query '{app="api"}' --from "2024-01-01T00:00:00Z" --to "2024-01-02T00:00:00Z"

Query a specific window

logcli query '{app="api"}' --limit 100 --forward

Streams tail from now

logcli CLI

6
logcli query '{app="nginx"} |= "error"' --tail

Tail matching logs live

logcli query '{app="api"}' --output raw --from DUR

Raw line output

logcli series --match='{namespace="prod"}'

Match stream series

logcli labels --since 24h

Labels seen recently

logcli query --help

All query flags

LOKI_ADDR=https://logs.example.com logcli query …

Point logcli at a remote Loki