loki commands

7 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 7 shown

  • Parse JSON logs and reshape line
    {app="api"} |= "error" | json | line_format "{{.level}} {{.msg}}"

    Filter by substring, parse JSON, render only chosen fields. note: | json before line_format.

    logql · observability · debug

  • Per-level log rate
    sum by (level) (rate({app="api"} | logfmt [5m]))

    Logs/sec grouped by level over 5m window. modern: logfmt parser for key=value lines.

    logql · rate · observability

  • Quantile over unwrapped latency
    quantile_over_time(0.99, {app="api"} | json | unwrap latency_ms [5m]) by (route)

    p99 latency from a numeric log field per route. note: unwrap needs a numeric label/field.

    logql · performance · observability

  • Count matching lines over time
    sum(count_over_time({namespace="prod"} |~ "timeout|deadline exceeded" [1m]))

    Count regex-matched error lines per minute across a namespace. |~ is regex match.

    logql · regex · troubleshooting

  • logcli ad-hoc query
    logcli query '{job="app/api"} |= "panic"' --since=1h --limit=200 --output=jsonl

    CLI query for last hour with line cap and JSONL output. set LOKI_ADDR env first.

    logcli · debug · observability

  • Loki query_range via API
    curl -sG "$LOKI_ADDR/loki/api/v1/query_range" --data-urlencode 'query=sum(rate({app="api"}[5m]))' --data-urlencode 'step=60' | jq '.data.result'

    Run a range metric query over HTTP and extract result with jq. step is in seconds.

    api · monitoring · observability

  • Push log lines to Loki
    curl -s -H 'Content-Type: application/json' -XPOST "$LOKI_ADDR/loki/api/v1/push" -d '{"streams":[{"stream":{"app":"test"},"values":[["'$(date +%s%N)'","hello loki"]]}]}'

    Manually push a log entry to verify ingestion. note: timestamp must be ns epoch.

    api · troubleshooting · observability