Trouble getting started with loki & grafana

[bioview]

question:How can I recreate the same bar graph as in the explorer.
Basically what I want is to visualize the Failed and Accepted logins in a rate per minute or hour.

I’m new to loki. My task: trying to visualize the authentication logins from sshd as logged in /var/log/auth.log

I’ve installed loki and promtail as described in https://levelup.gitconnected.com/loki-installation-in-ubuntu-2eb8407de291 and tried to make sense of the docs. I’m running the latest grafana afaik:8.1.3

in ‘explore’ I choose the loki datasource and create the query: {filename=“/var/log/auth.log”,job=“varlogs”}

and get the following screen:

The bar graph is basically what I was expecting,
The query inspector is showing the data I’m expecting to see.

However, I cannot find a way to translate this to a permanent graph in my dashboard, alongside other data like CPU, disk, temperature coming from telegraph.

The log panel shows the logs, but the graphs I tried give no data points and the query inspector shows:

Request:Object
url:"api/datasources/proxy/13/loki/api/v1/query_range?direction=BACKWARD&limit=400.75694444444446&query=rate(%7Bfilename%3D%22%2Fvar%2Flog%2Fauth.log%22%2Cjob%3D%22varlogs%22%7D%5B5m%5D)&start=1631471044360000000&end=1631557444360000000&step=300"
hideFromInspector:false
response:Object
message:"strconv.Atoi: parsing "400.75694444444446": invalid syntax
"
error:"Bad Request"
response:"strconv.Atoi: parsing "400.75694444444446": invalid syntax

How can I recreate the same bar graph as in the explorer.
Basically what I want is to visualize the Failed and Accepted logins in a rate per minute or hour

In the end I want to use loki to visualize data from slurm jobs submitted and other compute cluster logs or even event logs from lab equipment.

[dannykopping]

Your query:
{filename="/var/log/auth.log",job=“varlogs”}
is a log query; this will only return log lines. This is why the Logs panel works, but it cannot be turned into a graph, because a graph needs numeric values to plot.

In order to replicate the bar graph in Explore, you need to perform an aggregation (a metric query) on the data.
You could try count_over_time({filename="/var/log/auth.log",job=“varlogs”}[1m]) as your query in your graph panel.

More details in the docs:

LogQL

[bioview]

Thanks, I tried it among other things (with the help of your link and Cheat Sheet - Loki - Seb's IT blog)

It works fine in explorer, but in dashboards the query inspector always returns:
Object

request:Object

url:“api/datasources/proxy/13/loki/api/v1/query_range?direction=BACKWARD&limit=523.0069444444445&query=count_over_time(%7Bjob%3D%22varlogs%22%7D%5B1m%5D)&start=1631655392437000000&end=1631741792437000000&step=120”

hideFromInspector:false

response:Object

message:"strconv.Atoi: parsing “523.0069444444445”: invalid syntax "

error:“Bad Request”

response:"strconv.Atoi: parsing “523.0069444444445”: invalid syntax