Whats the current best practice for loki labels and streams

[sicaine]

Hi,

i was in the middle of creating a label for the http status code when i thought if this is reasonable to do so.

The blog article from 2020: How labels in Loki can make log queries faster and easier | Grafana Labs talks about it and funny enough uses the status code as an example.

But loki changed a ton over the years and i haven’t found a better answer yet.

Is there a newer guide on it? Is it even relevant for non high traffic situations?

My main current motivation / issue is not speed, its just that i would like to alert on a 500 and thats the first task for/with loki.

I’m also logging in json and assumed it would be much easier to have it as key/values and it would be much easier for searching. But if loki is not doing any prepocessing anyway and its just fulltext search, i might focus more on writing good filter queries.

[tonyswumac]

There is a label best practice page here: Best practices | Grafana Loki documentation

I would say your instinct is correct, that using return code as label probably isn’t ideal. You can alert with pattern recognization or full text search anyway.

But then again, if your concern isn’t performance oriented and you don’t have a ton of log, it’s likely not that big of a deal to go either way.