Displaying only loki log timestamp & content

[bluebatgames]

I recently started playing around with Loki, got it set up and accepting logs and now I’m looking at setting up a Grafana dashboard to display the logs. However I’ve run into a minor issue with how I’d like to set up the panel.

I’ve created a panel to show the current logs from a specific environment and source using the labels applied to the logs, but currently the list of logs shows the entire log content, including labels and detected fields, as one line, like so:

2021-02-05 11:37:05	

log="[05-Feb-2021 19:37:05 UTC] PHP Warning: count(): Parameter must be an array or an object that implements Countable in /var/www/html/blah.php on line 229" source=“phplog”

What I’d like is for it to just display the timestamp and then the content of the “log” field. Is it possible to do this or am I stuck with the default display format?

For the record, I’m working with Grafana v7.4.0.

Thanks

[ewelch]

Hrm, I’m not sure if my answer here is exactly what you are trying to do, but it looks like your log line might be logfmt which you could parse with the Loki query (in Loki > 2.0)

{app="foo"} | logfmt | line_format "{{.log}}"

But some form of extracting your log content with either the logfmt or regexp parser and then re-writing your log line with line_format might get you closer to what you are looking for?

Parser docs, scroll for the line_format docs

[bluebatgames]

@ewelch

| logfmt | line_format "{{.log}}"

That worked! Thank you. I’ll have to do some reading on the LogQL syntax.

Appreciate the help, thanks again.