Loki 速查表:80+ LogQL 查询、解析器、Promtail 管道与 HTTP API 参考

{app="nginx"}

{job="varlogs"}

{namespace="production"}

{app="nginx", env="prod"}

{job="nginx", namespace="prod", pod=~"api-.*"}

{app=~"api|frontend|backend"}

{namespace=~"prod|staging"}

{pod=~"api-[a-z]+-[0-9a-f]+"}

{job="prod", env!="dev"}

{namespace!="kube-system"}

{env!~"dev|staging|test"}

{namespace!~"kube-.*|istio-.*"}

{__filename__=~"/var/log/nginx/.*\.log"}

{__journal_SYSTEMD_UNIT__="nginx.service"}

sum(rate({app=~".+"} [5m])) by (app)

{namespace=~".+", env="prod"}

rate({app="api"} [5m] offset 1h)

rate({app="api"} |= "error" [5m]) / rate({app="api"} |= "error" [5m] offset 1d)

{app="nginx"} |= "error"

{app="api"} |= "ERROR" |= "timeout"

{app="api"} != "debug" != "trace"

{namespace="prod"} != "health check" != "heartbeat" != "ping"

{app="nginx"} |~ "5[0-9]{2}"

{app="api"} |~ "(?i)(error|fatal|panic)"

{app="worker"} |~ "^[0-9]{4}-[0-9]{2}-[0-9]{2}.*ERROR"

{app="api"} |= "request" !~ "health|ping|metrics"

{job="nginx"} !~ "2[0-9]{2}" |= "GET"

{app="api"} |= "error" |= "connection" != "debug"

{app="db"} |~ "deadlock|timeout" != "warning"

{app="api"} |> "<_> method=<method> path=<path> status=<status> <_>"

{app="api"} |= `"error": true`

{app="nginx"} |= `GET "/api/v1/users"` |= `"status": 500`

{app="api"} | json

{app="api"} |= "error" | json | __error__ = "" | level = "error"

{app="api"} | json status="response.status", user="auth.userId"

{app="api"} | json msg="message" | msg = "request completed"

{app="api"} | logfmt | level = "error"

{job="kube-apiserver"} | logfmt | component = "etcd" | err != ""

{job="nginx"} | pattern "<ip> - - [<_>] \"<method> <path> <_>\" <status> <size>"

{job="nginx"} | pattern "<ip> - - [<_>] \"<method> <path> <_>\" <status> <size>" | status = "500"

{job="app"} | regexp `(?P<level>\w+)\s+(?P<component>\[\w+\])\s+(?P<msg>.*)`

{job="packed-logs"} | unpack

{job="packed-logs"} | unpack | level = "error"

{app="api"} | json | line_format "{{.level | upper}} {{.ts}} {{.msg}}"

{app="api"} | logfmt | line_format "[{{.level}}] {{.component}}: {{.msg}}"

{app="api"} | json | label_format status_code=status

{app="api"} | logfmt | label_format level=lvl, message=msg

{app="colorful-app"} | decolorize | json

{app="cli-tool"} | decolorize | pattern "<level> <msg>"

{app="api"} | json | drop _entry, tenant_id

{job="nginx"} | pattern "..." | drop __filename__

{app="nginx"} | logfmt | level = "error"

{app="api"} | json | env = "prod" | service = "payments"

{app="nginx"} | json | status != "200"

{app="api"} | logfmt | level != "info" | level != "debug"

{app="nginx"} | json | method =~ "POST|PUT|PATCH"

{app="api"} | logfmt | level =~ "error|fatal|panic"

{app="api"} | json | duration > 500ms

{app="db"} | logfmt | query_time >= 2s | query_time < 30s

{app="storage"} | json | response_bytes > 1mb

{job="nginx"} | pattern "... <status> <bytes>" | bytes > 1024

{app="api"} | json | __error__ = "" | level = "error"

{job="nginx"} | logfmt | __error__ = "" | status > 499

{app="api"} | json | level = "error" | duration > 1s | service = "payments"

rate({app="nginx"} [5m])

sum(rate({namespace="prod"} [5m])) by (app)

count_over_time({app="nginx"} |= "error" [1h])

sum(count_over_time({namespace="prod"} [1d])) by (app)

sum(bytes_over_time({namespace="prod"} [1h])) by (app)

sum(bytes_rate({namespace="prod"} [5m])) by (app)

topk(5, sum(bytes_rate({} [5m])) by (job))

sum(rate({app=~"api|frontend"} |= "error" [5m])) by (app)

rate({app="nginx"} | json | status =~ "5.." [5m])

sum(rate({app="api"} | json | __error__ = "" | status > 499 [5m])) by (path)

rate({job="nginx"} | pattern "<_> <status> <_>" | status =~ "5.." [5m])

topk(10, sum(rate({namespace="prod"} [5m])) by (app))

bottomk(3, sum(bytes_rate({} [5m])) by (namespace))

increase({app="worker"} |= "job failed" [24h])

sum(increase({namespace="prod"} |= "panic" [1h])) by (app)

sum(rate({} [5m])) by (app, namespace)

sum(bytes_rate({namespace="prod"} [5m])) by (app)

avg(rate({namespace="prod"} [5m])) by (app)

max(rate({namespace="prod"} [5m])) by (pod)

topk(5, sum(rate({namespace="prod"} |= "error" [5m])) by (app))

bottomk(5, sum(bytes_rate({namespace="prod"} [5m])) by (app))

sum without (pod, instance) (rate({namespace="prod"} [5m]))

count(rate({namespace="prod"} [5m])) by (app)

{app="api"} | json | unwrap response_ms

{app="api"} | logfmt | unwrap duration(request_time)

{app="storage"} | json | unwrap bytes(response_size)

quantile_over_time(0.50, {app="api"} | json | unwrap duration_ms [5m]) by (path)

quantile_over_time(0.99, {app="api"} | logfmt | unwrap duration(resp_time) [5m]) by (endpoint)

avg_over_time({app="api"} | logfmt | unwrap duration(resp_time) [5m]) by (service)

max_over_time({app="api"} | json | unwrap duration_ms [5m]) by (path)

min_over_time({app="cache"} | json | unwrap hit_rate [5m])

sum_over_time({app="gateway"} | logfmt | unwrap bytes(transferred) [1h])

first_over_time({app="api"} | json | unwrap status [5m]) by (host)

last_over_time({app="api"} | json | unwrap queue_size [1m])

absent_over_time({app="backup-job", env="prod"} [30m])

absent_over_time({job="heartbeat", host="server-01"} [5m])

sum(rate({app="api"} |= "error" [5m])) / sum(rate({app="api"} [5m])) * vector(100)

label_replace(sum(rate({app} [5m])) by (host), "short", "$1", "host", "([^.]+).*")

pipeline_stages:
  - regex:
      expression: '(?P<level>INFO|WARN|ERROR|DEBUG)'
  - labels:
      level:
  - timestamp:
      source: time
      format: RFC3339

- regex:
    expression: '^(?P<ip>\S+) \S+ \S+ \[(?P<ts>[^\]]+)\] "(?P<method>\w+) (?P<path>\S+)[^"]*" (?P<status>\d{3}) (?P<bytes>\d+)'

- regex:
    source: message
    expression: 'error: (?P<error_code>[A-Z0-9_]+)'

- json:
    expressions:
      level: level
      msg: message
      ts: timestamp

- json:
    source: attributes
    expressions:
      user_id: userId

- labels:
    level:
    app:
    env:

- labels:
    level:      # source key from extracted map
    component:  # same name, same key

- timestamp:
    source: ts
    format: RFC3339

- timestamp:
    source: log_time
    format: "2006-01-02T15:04:05.000Z07:00"
    fallback_formats: ["2006-01-02 15:04:05"]

- multiline:
    firstline: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
    max_wait_time: 3s
    max_lines: 128

- json:
    expressions:
      msg: message
- output:
    source: msg

- pack:
    labels:
      - level
      - component

auth_enabled: false

# multi-tenant header:
# X-Scope-OrgID: my-org-id

server:
  http_listen_port: 3100
  grpc_listen_port: 9096
  log_level: info

ingester:
  wal:
    enabled: true
    dir: /loki/wal
  lifecycler:
    ring:
      kvstore:
        store: memberlist
      replication_factor: 3

schema_config:
  configs:
    - from: 2020-10-24
      store: boltdb-shipper
      object_store: filesystem
      schema: v11
      index:
        prefix: index_
        period: 24h
    - from: 2023-01-01
      store: tsdb
      object_store: s3
      schema: v12
      index:
        prefix: loki_index_
        period: 24h

storage_config:
  aws:
    s3: s3://us-east-1
    bucketnames: my-loki-chunks
  boltdb_shipper:
    active_index_directory: /loki/index
    cache_location: /loki/cache
    shared_store: s3

limits_config:
  ingestion_rate_mb: 16
  ingestion_burst_size_mb: 32
  max_streams_per_user: 100000
  max_query_length: 721h
  retention_period: 30d

ruler:
  enable_api: true
  enable_alertmanager_v2: true
  alertmanager_url: http://alertmanager:9093
  storage:
    type: local
    local:
      directory: /loki/rules

groups:
  - name: loki-alerts
    rules:
      - alert: HighErrorRate
        expr: |
          sum(rate({app="api"} |= "error" [5m])) by (env)
          / sum(rate({app="api"} [5m])) by (env) > 0.05
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Error rate > 5% for {{ $labels.env }}"
      - alert: ServiceSilent
        expr: absent_over_time({app="cron"} [30m])
        for: 0m
        labels:
          severity: critical

compactor:
  working_directory: /loki/compactor
  shared_store: s3
  retention_enabled: true
  retention_delete_delay: 2h
  retention_delete_worker_count: 150

curl "http://localhost:3100/loki/api/v1/query?query=%7Bapp%3D%22nginx%22%7D&limit=50"

curl -G --data-urlencode 'query={app="nginx"} |= "error"' http://localhost:3100/loki/api/v1/query

curl "http://localhost:3100/loki/api/v1/query_range?query=%7Bapp%3D%22nginx%22%7D&start=1704067200000000000&end=1704153600000000000&step=60"

curl http://localhost:3100/loki/api/v1/labels

curl -G --data-urlencode 'query={namespace="prod"}' http://localhost:3100/loki/api/v1/labels

curl http://localhost:3100/loki/api/v1/label/app/values

curl -G --data-urlencode 'query={namespace="prod"}' http://localhost:3100/loki/api/v1/label/app/values

curl -G --data-urlencode 'match[]={app="nginx"}' http://localhost:3100/loki/api/v1/series

curl -G --data-urlencode 'match[]={namespace="prod"}' http://localhost:3100/loki/api/v1/series

curl -X POST http://localhost:3100/loki/api/v1/push \
  -H 'Content-Type: application/json' \
  -d '{
  "streams": [{
    "stream": {"app": "myapp", "env": "prod"},
    "values": [["'$(date +%s%N)'", "log message here"]]
  }]
}'

wscat -c "ws://localhost:3100/loki/api/v1/tail?query=%7Bapp%3D%22nginx%22%7D&limit=20"

curl -G --data-urlencode 'query={namespace="prod"}' "http://localhost:3100/loki/api/v1/index/stats?start=1704067200000000000&end=1704153600000000000"

curl http://localhost:3100/ready

curl http://localhost:3100/metrics | grep loki_ingester

curl http://localhost:3100/config | less