Logql syntax error

[jlbprof]

Logql question, could not find a tag for it

I am totally new to Grafana/Loki/Prometheus/logql, frankly I am having a very difficult time figuring anything out.

But I have dragged it to this point. I have used promtail to bring in my apache access logs (albeit could not figure out pipeline stages, so am using apache piped logs to transform it and filter out).

I have a small set of log entries about 300.

For this exercise I want to just count how many 500 errors.

In grafana, I have setup a panel with logs display, using this logql

{job="apache_access"} | json | status = "500"

That displays in the log type display my entries.

So I switch to stat display and try to change it to:

count({job="apache_access"} | json | status = "500")

And it says: parse error at line 1, col 52: syntax error unexpected )

Count is a legit metric according to the logql manual, what am I doing wrong?

Thanx

[b0b]

Hi @jlbprof ,

welcome to the Loki adventure

It took some time to understand LogQL and I am by no means an expert… I tried a similar query to yours and got the same error. Seems like you can only use count on an other aggregation.

E.g. this worked for me

count(count_over_time({my_label="my_label_value"}[10m]))

[jlbprof]

Than you for your reply.

count_over_time({job="apache_access"} | json | status == 500[30m])

Gets mucho errors related to json.

Yet

count_over_time({job="apache_access"}[30m])

Works

Has a lot of parsing errors. Am I only allowed to count over the entire list, and cannot pair it down?

Thank you

[b0b]

Not sure if I can help much more than that… One thing I can say is that the json parser will slow things down quite a bit and can report many parsing errors.

This

{my_label="my_label_value"} != "\"log.level\": \"INFO\""

will be much faster than this

{my_label="my_label_value"} | json  | log_level!="INFO"