Archived logs from Cloud Logs Export cannot be queried by logcli

Grafana Cloud
, ,
1

Hello,

I’m currently evaluating of a long term log archival solution for compliance purpose with Grafana Cloud. I found this feature is supported by a plugin called Grafana Cloud Logs Export (Easily export Grafana Cloud logs to your object storage).

For the context, as I’m not using AWS so I had tried:

  • Azure: the instruction in the plugin UI (in Grafana Cloud) doesn’t seem to be detail enough for a newbie as me to make the config work (the URL redirection give nothing, and the Grafana client id doesn’t seem to exist). I made some attempts but I couldn’t make it connect to a designated Azure blob storage due to permission issue.
  • Google Cloud: the instruction is a bit better. I managed to connect the plugin to a GCS bucket. The plugin does write logs properly to the bucket as in this screenshot:

image
image716×212 26.7 KB

Once I have the GCS working, I tried to query it with the logcli as suggested here (Query your exported logs | Grafana Cloud documentation) with the following config (side note: there is indentation issue with the sample GCS config in the documentation).

storage_config:
  tsdb_shipper:
    shared_store: gcs
    cache_location: /tmp/logcli
  boltdb_shipper:
    shared_store: gcs
    cache_location: /tmp/logcli
  gcs:
    bucket_name: <my_bucket_name>

Note that, I do have gcloud and gsutil commands working in my terminal.

When I tried to run the logcli command:

./logcli query --store-config=logcli-config.yml --remote-schema  --from="2024-05-03T12:00:00Z" --to="2024-05-03T20:15:00Z" --org-id 117449  --output=jsonl '{job="htoh-api"} |= ``'

This error always comes up:

2024/05/04 07:11:54 Query failed: 2 errors: yaml: unmarshal errors:
  line 8: field path_prefix not found in type struct { Prefix string "yaml:\"prefix\""; Period model.Duration "yaml:\"period\""; Tags config.Tags "yaml:\"tags\"" }
  line 22: field path_prefix not found in type struct { Prefix string "yaml:\"prefix\""; Period model.Duration "yaml:\"period\""; Tags config.Tags "yaml:\"tags\"" }
  line 36: field path_prefix not found in type struct { Prefix string "yaml:\"prefix\""; Period model.Duration "yaml:\"period\""; Tags config.Tags "yaml:\"tags\"" }
  line 50: field path_prefix not found in type struct { Prefix string "yaml:\"prefix\""; Period model.Duration "yaml:\"period\""; Tags config.Tags "yaml:\"tags\"" }; failed to load schema object 'schemaconfig.yaml': storage: object doesn't exist

Do you have any idea of what I’m missing here?

2

Hi!

I am having a similar issue. As a workaround I manually renamed the file to schemaconfig.yaml and manually removed the path_prefix key from the yaml file. Then I don’t get an error but also don’t get any query results. There is no error code.