How to query Grafana Loki with LogQL  ## Metadata - Author: [[Grafana]] - Full Title: How to query Grafana Loki with LogQL - Category: #articles - Document Note: --- tags: - #grafana - #loki - #logql - #logging Author: Grafana Labs (YouTube Tutorial) Source: Grafana Labs YouTube Channel Reference: https://www.youtube.com/watch?v=57dQwcmqkpQ date created: 2025-08-21 15:45 --- # Title: How to Query Grafana Loki with LogQL ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [0:00–0:45 Intro: Why Query Loki](#000-045-intro-why-query-loki) - [0:46–2:28 Grafana Play: Testing Without Setup](#046-228-grafana-play-testing-without-setup) - [2:29–3:54 Intro to LogQL](#229-354-intro-to-logql) - [3:55–5:28 Query Structure & Execution](#355-528-query-structure--execution) - [5:29–7:20 Filtering by Labels & Operators](#529-720-filtering-by-labels--operators) - [7:21–9:15 LogQL Expressions: Filters, Parsers, Formatters](#721-915-logql-expressions-filters-parsers-formatters) - [9:16–11:15 Filtering, Parsing & JSON Handling](#916-1115-filtering-parsing--json-handling) - [11:16–13:09 Formatting Outputs & Log vs Metric Queries](#1116-1309-formatting-outputs--log-vs-metric-queries) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: The video introduces developers to querying logs in **Grafana Loki** using **LogQL**, Loki’s log query language. It covers querying with predefined dashboards in Grafana Play, constructing queries with log stream selectors, using operators and pipelines, and applying filters, parsers, and formatters for deeper insights. The tutorial highlights both **log queries** (string outputs) and **metric queries** (numerical results), making LogQL powerful for both exploration and monitoring. --- ## 📖 Main Content: ### [0:00–0:45 Intro: Why Query Loki](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=0) - Logging is only useful if queries make sense of data. - Loki users must learn **LogQL** for extracting meaningful insights. --- ### [0:46–2:28 Grafana Play: Testing Without Setup](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=46) - Grafana Play: playground with no sign-in required. - Pre-built dashboards help beginners explore logs quickly. - Clicking panels exposes underlying queries for modification. --- ### [2:29–3:54 Intro to LogQL](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=149) - Schema defined **at query time** (flexibility with log formats). - Pipe-based structure, similar to **Bash**. - Scalar/vector support allows string-to-number aggregation. --- ### [3:55–5:28 Query Structure & Execution](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=235) - Queries start with **log stream selector** `[labels]`. - Operators refine logs (e.g., `=`, `!=`, regex). - Can run in Grafana UI or via **LogCLI**. --- ### [5:29–7:20 Filtering by Labels & Operators](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=329) - Label-based filtering: cluster, pod, error levels. - Operators include equals, not equals, regex. - Example: filter logs to only show `error` from a specific cluster. --- ### [7:21–9:15 LogQL Expressions: Filters, Parsers, Formatters](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=441) - Three expression types (least → most computationally expensive): 1. **Filters** – search strings and labels. 2. **Parsers** – interpret formats like JSON. 3. **Formatters** – adjust displayed output. - Best practice: order by efficiency. --- ### [9:16–11:15 Filtering, Parsing & JSON Handling](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=556) - JSON logs easily parsed for keys/values. - Example: `status = 200`. - Regular expressions refine log outputs. - Supports logical chaining with AND/OR. --- ### [11:16–13:09 Formatting Outputs & Log vs Metric Queries](https://www.youtube.com/watch?v=57dQwcmqkpQ&t=676) - Use `line_format` to show only specific fields. - Example: display only HTTP method and request. - Difference: - **Log queries** → string results. - **Metric queries** → numeric/aggregated results. --- ## 🗒️ Notes - Loki queries use **selectors**, **pipes**, and **operators**. - Grafana Play is beginner-friendly, no setup. - Filters are efficient, parsers interpret structured data, formatters improve readability. - Output types: **logs (strings)** vs **metrics (numbers)**. - Encourages exploratory learning: tweak existing queries instead of starting from scratch. --- ## 📖 References: - Grafana Loki: https://grafana.com/oss/loki/ - LogQL Docs: https://grafana.com/docs/loki/latest/logql/ - Grafana Play: https://play.grafana.org/ --- ## 🗣️ Paraphrase: 1. Original: *“Loki doesn’t require your data to follow a schema; queries define it.”* Paraphrased: Instead of enforcing strict formats, Loki lets you shape your schema inside each query. 2. Original: *“Use line_format to only show what matters.”* Paraphrased: You can slim down query outputs by formatting them to reveal only chosen fields, making results cleaner. --- ## 📰 Newsletter: **🔥 Log Smarter with Grafana Loki** Logs piling up? Don’t panic—Grafana Loki + LogQL has your back. This week, we spotlight how to **query smarter, not harder**. Using Grafana Play, you can test queries risk-free. LogQL’s pipes, filters, and formatters help you cut through noise—whether you’re chasing down error rates or trimming JSON clutter. 👉 Dive in: [LogQL Docs](https://grafana.com/docs/loki/latest/logql/) 👉 Try it: [Grafana Play](https://play.grafana.org/) Keep shipping code, not headaches. 🚀 --- ## ✅ Action Items: - Encourage open-source contributors to use **Grafana Play** for onboarding exercises. - Integrate LogQL labs in **WordPress training sessions**. - Propose **introductory Loki workshops** for community contributor days. - Advocate for **open observability** in OSPO discussions. - Highlight LogQL in **educator-friendly materials** (step-by-step, visual aids). --- ## 🧪 Hypotheses: - Using Grafana Play reduces onboarding friction for new OSS contributors. - Developers who adopt filters-first strategies write more performant queries. - Teaching LogQL alongside PromQL accelerates DevOps maturity. --- ## 📊 Methodology: - Run controlled workshops with/without Grafana Play. - Collect logs of query execution times for filter vs parser-first approaches. - Compare OSS contributor retention after observability-focused onboarding. --- ## ❓ Questions: - How can LogQL be taught to non-developers in OSS projects? - Could WordPress adopt Loki for plugin observability? - Is LogQL adoption a barrier for smaller dev teams without monitoring expertise? --- ## 🔮 Future Research: - Explore extending LogQL for real-time security event detection. - Test adoption in CMS ecosystems (e.g., WordPress, Drupal). - Research inclusive teaching strategies for observability concepts. --- ## 💡 Implications: - Broader adoption strengthens OSS infrastructure reliability. - Contributor training in observability builds **resilient communities**. - Transparent log analysis supports **inclusive governance**. --- ## 🧠 Learning Styles Assessment: - **Reading Level**: Technical, ~12th grade+. - **Visual**: Demo dashboards help, could add infographics. - **Auditory**: Video narration supports auditory learners. - **Verbal**: Clear analogies (pipes = Bash). - **Kinesthetic**: Needs interactive labs. - **Logical**: Strong flow, schema-at-query-time reasoning. - **Social**: Lacks community prompts. - **Solitary**: Few reflection opportunities. - **Naturalistic**: No real-world nature analogies → could add e.g., “logs as ecosystems.” --- ## 📊 Accessibility Assessment: - Captions available ✅. - Needs alt-text for screenshots. - Could improve keyboard navigation. - Contrast is solid but font resizing may break UI. --- ## 🌍 DEIB Assessment: - Neutral tone, but lacks cultural/global examples. - Technical jargon → barrier for newcomers. - Inclusive in tone but not diverse in examples. - Recommend adding diverse OSS contributor voices. --- ## ✅ Logical Validity: - **Strengths**: - Causal reasoning (filters faster → order matters). - Good analogies (pipes like Bash). - Deductive clarity (selectors + operators → query results). - **Weaknesses**: - Slight **appeal to authority** (“use Grafana Play because Grafana made it”). - Missing counterpoints (alternatives to Loki). --- ## 🔍 DARVO Analysis: - **Deny**: None—content never denies flaws. - **Attack**: None—no adversarial tone, no dismissal of alternatives. - **Reverse Victim & Offender**: None—no reframing Loki/Grafana as victims. - **Tone**: Helpful, neutral, educational. - **Fallacies**: Minimal; only light **appeal to authority**. → Conclusion: No DARVO tactics present. --- ## 🔍 SEO Evaluation: - **Keywords**: “Grafana Loki,” “LogQL,” “query logs.” Present naturally. - **Meta**: Needs optimized description. - **Title**: Strong, contains keyword. - **Headers**: Structured well with keywords. - **Length**: ~2,000 words equivalent. - **Links**: Strong, but add OSS community links. - **Images**: Should add alt-text. - **Mobile**: Video responsive. - **Schema**: Missing article schema. - **Social**: Needs Open Graph/Twitter Cards. --- ## 🎯 Conclusion: LogQL transforms Grafana Loki from a log bucket into a powerful observability tool. The tutorial explains query construction, filtering, parsing, and formatting in practical, approachable steps. By making logs navigable, it empowers both enterprises and OSS communities to monitor, debug, and grow with resilience. - Summary: In this video, Senior Developer Advocate Nicole van der Hoeven talks about how to query Grafana Loki with LogQL. She talks about different ways to query Loki without using LogQL, how to get started with LogQL, and the three types of expressions that can be used in LogQL. TIMESTAMPS 00:00 Intro 00:21 Querying Loki without using LogQL 02:27 What is LogQL? 05:13 Structure of a LogQL query 08:20 Filter expressions in LogQL 10:10 Parser expressions in LogQL 10:57 Format expressions in LogQL HELPFUL LINKS Grafana Play: https://gra.fan/play Docs on LogQL: https://gra.fan/lokiquery Loki docs: https://gra.fan/lokidocs ☁️ Grafana Cloud is the easiest way to get started with Grafana dashboards, metrics, logs, and traces. Our forever-free tier includes access to 10k metrics, 50GB logs, 50GB traces and more. Sign up: https://grafana.com/get/?src=yt&mdm=social&cnt=description ❓ Have a question that isn't related to this video? Check out the Official Grafana Community Forums: https://community.grafana.com/?src=yt&mdm=social&cnt=description ----- 👍 If you found this video useful, be sure to give it a thumbs up and subscribe to our channel for more helpful Grafana videos. 📱 Follow us for the latest and greatest on all things Grafana and our other OSS projects. X: (https://www.twitter.com/grafana) LinkedIn: (https://www.linkedin.com/company/grafana-labs/) Facebook: (https://www.facebook.com/grafana) #Grafana #Observability - URL: https://youtube.com/watch?v=57dQwcmqkpQ&si=gl92Ba8X41Nf9-WW So, you've got your servicesinstrumented in sending logs to Loki.What's next? All the logs in the worldwon't help you unless you know how tofind meaningful information within them,which means that at some point, you'regoing to have to learn how to queryLoki. In this video, I'm going to talkabout Log, which is Loki's log querylanguage, and I'll walk you through howto get started with it. But first, let'stalk about some alternatives to Log. Maybe you don't really know if you wantto commit to learning a new querylanguage just to be able to query yourlogs. Well, your first stop I would saywould be to try to use logs drill down. Welcome to Grafana Play. This isplay.grafana.org. And the cool thingabout it is that you don't need to signin at all. You don't need any account orcredit card information or anything.This is, well, just a playground for youto kind of try things out. And one ofthe cool things that you can try out isover here under drill down you can gointo logs and then you'll already beable to see a bunch of different queriesthat have been pre-selected for you. Nowthis is also dependent on the service. That you’ve got. We have a few here thatyou can choose from. This is really justa place where you can go and alreadyhave readymade charts and graphs andalso log lines that you can playaround with. This is great because youdidn’t need to do any of these queries.You can already look at labels. We tryto figure out what you’re going to belooking for, and then we put graphs forthe most common use cases that we couldthink of in here. This is constantlyevolving, but if you’re not quite surewhat you’re looking for and you justkind of want to have a look at your dataand play around with it, this is a greatplace to start. No LogQL required. The second step, if you want to look alittle more closely, is to go into oneof these. Let’s say this detected levellabel, you can click on the select here.There’s a bunch of other graphs here.But if you want to know what query thisis and maybe just edit it a little bit,you could click here and then click onexplore. And now you can see exactly thequery that was used to create thisgraph. So then you can changethe service name here maybe or add somemore conditions here. You can create queries without beginningentirely from scratch. If you alreadysee a dashboard panel that looks sort oflike what you had in mind, then startwith that, take the query, and then justgo from there. Now let's talk aboutLogQL. LogQL has a fewfeatures that you need to know about.First, it enables schema at query. So,unlike other databases, Loki doesn’trequire your data to follow a particularstructure or schema. Instead, it kind oflets you define that schema within yourquery. So, it’s really okay if you have alot of different log lines in differentformats. Loki is not going to choke onit. You’re going to be able to determinewhat it looks for in the query itself. LogQL is also pipe-based. You might befamiliar with this from a language likeBash. Log queries are often broken apartby these pipe characters. And what thatmeans is that there's going to be anoperation on the left of the pipe. Thatresult from that operation is then goingto be passed in as input for theoperation to the right of the pipe. Andin this way, you kind of get this funneltype filtering for your results. At theend of it is the actual set or subset ofLogs that you're looking for. Log alsohas scalar vector support. Logs can bekind of tricky to aggregate becausethey're strings. But with Loki, you canquery it for strings in your logs andalso instruct it to turn those stringsinto numbers that you can thenaggregate. So this is useful for whenyou want to get the rate of logs orcount the number of instances that acertain string appears in a log line. Log supports both filtering and parsing.Filtering is searching lines and labelsfor a specific string. And parsing meansinterpreting the line based on a givenformat and then returning elements basedon that. So for example, most of theselog lines are in JSON format, and you canjust click on JSON here and then searchLoki based on these objects. Sometimesyour query might not return results in aformat that is human-readable. Andthat's okay because with LogQL you canalso format the way that those resultsare displayed within the query itselfusing formatters. Log is also heavilybased on PromQL, which is the querylanguage for Prometheus. But really, youdon't need to know either Prometheus orPromQL to be able to write LogQL queries. In the rest of this video, I’m going toassume you don’t know anything aboutPrometheus or PRMQL. LogQL can be run onGrafana. Right now, this query is beingexecuted on Grafana, and I can changethe query and also re-execute it directlyfrom Grafana, but you can also use the logCLI, which is a command line interfacespecifically for interacting with Loki.You can use it to run queries as well asretrieve information about the queriesthat have already been run on thestructure of a LogQL query. A queryalways starts with a log stream selector inbrackets, and then optionally, you can adda pipe and then what’s called a logpipeline. Let’s talk about what thatmeans. The log stream selector, which youwrite in brackets, is where you definethe labels that you want to search on. So this is also where you can determinethe stream or the unique combination ofkey-value pairs that you’re particularlylooking for in this query. And there area bunch of operators that you can use.Let’s go back to Grafana Play here andthen go to logs drill down again. Let’sselect "Show Logs" here, and I’m going togo to the log section just so we seethem all. I want to search for. I’m going to clickon Explore here, just so we get a littlequery thing here, and I’m going to removethat. Then I’m going to type abracket. Just typing the bracket showsall of the labels that are alreadyavailable for me to select. So, I’m justgoing down here to choose the one that Iwant. Let’s say I want level. And I hitenter. Then it’s telling me whatelse I can select. So, I’m going tosay I’m only really interested in error. If I want to, I can alreadyrun this. I’m just going to hit Shiftenter. These are the results of thatquery. Now, all that I see here are theones where level equals error. But whatif I only want the ones from aparticular cluster? Well, then I can goback to the query here. I can add acomma, and I already see a bunch oflabels that are available. So, I’llclick on cluster. Let’s say I’m onlyinterested in EU ones because I’m in theEU. I’m going to hit Shift enter. Andnow I’ve filtered the query down even more,so that now I’m only seeing errors fromthis particular cluster. If I wanted tothough, I could hide the ones from EUWest. Equals. So it's not EU West. So let merun that. And then everything that'shere should not be from cluster E West.So this one, for example, is US West,which is great. There are otheroperators that you can use here otherthan equals and not equal to. You canplay around with regular expressions. Soyou can say that only the ones thatmatch a regular expression are goingto show up or the ones that don't matcha regular expression show up in yourresults. Now let's talk about the logpipeline, which is the optional way tokind of narrow down the query after youdefine the log stream selectors. First wecan put a pipe character here. Rememberthat the previous log results fromthis log stream selector will then beused as input for whatever we putafterwards. Luuals always parse from theleft to the right. So I'm going to talkabout three types of expressions that gointo the log pipeline and I'm going tobe mentioning them in the order from theleast expensive computationally to the most expensive. This also means that ifyou care about how fast your query runs,then you should try to prioritize theexpressions in the order that I'm goingTo tell you, filters, parsers, andformatterers. First is filterexpressions. Filter expressions are usedto look for a certain string or range ofvalues within the log line or label. Forline filters, the following operatorscan be used. You can say that you wantthe log lines to contain a string, notcontain a string, or contain or notcontain a match to the regularexpression that you specify. Let's sayin this case that we are particularlylooking for this error: "failed to getkeys from memcache." So, I'm just goingto copy that and then go up here to thequery. I'm going to put an equal signbecause what I'm saying here is I wantlogs that have that error leveland within this cluster because I'mgoing to remove the not equals there. And then I want those log lines tocontain the phrase, the string "failed toget keys from memcache." So, shift enterthere. And now all of them have thatstring and are also within that cluster. What if I wanted something that doesn'tcontain that? Well, then I could just donot equals here. Run that. And now I'mlooking at errors that are still withinthat cluster and are still level equals. Error, but they no longer have thisstring. For label filters, I can alsouse operators like the equal sign and notequals for inequality. Or I can doless than or greater than, less than,equal to, and that sort of thing. So forexample, I could put a pipe here andI’ll say I’m looking for something fromthis pod in particular. Now, these arethe errors for that specific pod. So ifI click into that, sure enough, it’sfrom that particular tempo, and you canalso use "and" or "or" to chain operationsfor label filters. The second type ofexpression is parser expressions. Parserexpressions are used to easily filter logs that are in a standardized formatlike JSON, log fmt, regular expressions,or unpack. In this new example, the logsare mostly in JSON. So I could dosomething like, you know, put a pipeequals here and then copy somethingspecifically. So host and then do thator I can just say, you know, what I justwant this in JSON, and then I caninteract with the object specifically.So then I’ll put another pipe here. ThenI’ll say that the status should be equalto 200. Now everything that I get willonly have the status equals 200. The third type of expressions is calledformat expressions. Format expressionscan be used to change the way that linesor labels are displayed using functionslike line format or label format. Formatexpressions don’t change the underlyingsource data, only the results that arereturned by the query. If we go back tothis query, you’ll see that the resultshave a lot of information here. But whatif we don’t need to know all of thatinformation? Maybe we just want someinformation, like maybe the method andlet’s see the request, perhaps. So thisURL that was being requested. So we could put a pipeline thereand then I’m going to put line formatand then have these quotes here and thenput these curly braces, and that’s goingto allow us to set the fields thatwe want to include. So in this one, wewant, let’s say,method, and then a colon, and then let’ssay we want the request. So basically,just these two and nothing else. So I’mgoing to run that, and you’ll see thatthe results now are much more concise.You’ll still have the timestamp becausethat’s always there by default. Understand what's happening withouthaving the entire JSON body there to gothrough. Those are the basics ofconstructing a LogQL query. There areactually two types of log queries, bothof which follow the same basicstructure: log queries and metricqueries. Log queries are queries whoseoutput remain strings, structured orotherwise. That’s what I showed here.This is a log query. Metric queriesreturn results that are numbers orvectors of numbers, but we’ll cover thatin the future. There’s actually a lotmore to cover about LogQL in general,but that should get you started for now.If you’d like to learn more about bestpractices for writing queries in Log,then check out this Loki community callthat I did with my colleagues JayClifford and Sirill Divera, where we goover the top mistakes when writingqueries, how to write performantqueries, and more. Thanks for watching.See you in the next one., How to query Grafana Loki with LogQL, Grafana, 01jyj4xn1z78pzx50j2j9qt1zg.