I have a Grafana dashboard that displays logs for several pods in a kubernetes e…nvironment. We ingest logs from both console and log files, and apply a `source` label to differentiate these. In the dashboard we allow selecting the Kubernetes namespace, Kubernetes pod and source using dropdowns (Grafana variables) so the user can select which logs he wants to see.
One of these pods only outputs a single log line every +- 15 minutes. For this pod, I noticed that the `source` dropdown will not get filled in, i.e. **the Grafana label_values call fails for Loki data** . This causes it to default to `None`, and applied to the LogQL query, results in no logs being found. In the end, it seems that there are no logs, while in fact there are.
For reference, the `source` variable is a Grafana configured as: `label_values({namespace="$namespace", pod="$pod"}, source)`
I tracked this problem down to the Loki series API, as this is the one [used by `label_values`](https://grafana.com/docs/grafana/latest/datasources/prometheus/template-variables/).
When using the `/api/v1/series` API, Loki returns no data.
```
curl -g 'http://localhost:42135/loki/api/v1/series?end=1672767401037029205&start=1672763401037029205' --data-urlencode 'match[]={namespace="devic1-shared",pod="yarn-resourcemanager-0-0"}'
{"status":"success","data":[]}
```
However, when using the `/api/v1/query_range` over the same time range, data is returned:
```
curl -G -s 'http://localhost:42135/loki/api/v1/query_range?' --data-urlencode 'end=1672767401037029205' --data-urlencode 'start=1672763401037029205' --data-urlencode 'query={namespace="devic1-shared",pod="yarn-resourcemanager-0-0"}' | jq
{
"status": "success",
"data": {
"resultType": "streams",
"result": [
{
"stream": {
"component": "resourcemanager",
"filename": "/var/lib/kubelet/pods/d59a01f9-8733-4560-b7cc-78cd0514c375/volumes/kubernetes.io~empty-dir/logs/gc.log",
"job": "devic1-shared/yarn",
"namespace": "devic1-shared",
"node_name": "10.178.0.95",
"pod": "yarn-resourcemanager-0-0",
"source": "gc.log",
"app": "yarn"
},
"values": [
[
"1672766971030608973",
"[2023-01-03T17:29:30.927+0000][94592.430s][1] GC(152) Pause Young (Normal) (G1 Evacuation Pause) 125M->39M(145M) 1.925ms"
],
[
"1672766250984737472",
"[2023-01-03T17:17:30.950+0000][93872.452s][1] GC(151) Pause Young (Normal) (G1 Evacuation Pause) 125M->39M(145M) 26.382ms"
],
[
"1672765471022969603",
"[2023-01-03T17:04:30.927+0000][93092.430s][1] GC(150) Pause Young (Normal) (G1 Evacuation Pause) 125M->39M(145M) 1.888ms"
],
[
"1672764691019264949",
"[2023-01-03T16:51:30.954+0000][92312.457s][1] GC(149) Pause Young (Normal) (G1 Evacuation Pause) 125M->39M(145M) 28.135ms"
],
[
"1672763970962902691",
"[2023-01-03T16:39:30.944+0000][91592.446s][1] GC(148) Pause Young (Normal) (G1 Evacuation Pause) 125M->39M(145M) 19.950ms"
]
]
}
],
"stats": {
"summary": {
"bytesProcessedPerSecond": 231286,
"linesProcessedPerSecond": 1644,
"totalBytesProcessed": 703,
"totalLinesProcessed": 5,
"execTime": 0.00303952,
"queueTime": 6.1705e-05,
"subqueries": 1,
"totalEntriesReturned": 5
},
"querier": {
"store": {
"totalChunksRef": 0,
"totalChunksDownloaded": 0,
"chunksDownloadTime": 0,
"chunk": {
"headChunkBytes": 0,
"headChunkLines": 0,
"decompressedBytes": 0,
"decompressedLines": 0,
"compressedBytes": 0,
"totalDuplicates": 0
}
}
},
"ingester": {
"totalReached": 1,
"totalChunksMatched": 0,
"totalBatches": 1,
"totalLinesSent": 5,
"store": {
"totalChunksRef": 5,
"totalChunksDownloaded": 5,
"chunksDownloadTime": 521213,
"chunk": {
"headChunkBytes": 0,
"headChunkLines": 0,
"decompressedBytes": 703,
"decompressedLines": 5,
"compressedBytes": 778,
"totalDuplicates": 0
}
}
}
}
}
}
```
The strange thing is, the behavior of the first query depends on when exactly you execute it:
- < 5 mins after a log entry was ingested: the query will return the series
- > 5 mins, < X: the query will return empty (as above)
- > X (at some point in the future, I am unsure what triggers this): the query will return the series
I am using Loki v2.6.1.