Hello,
I have a log in the following format in Loki:
{
“ip_addr”: “T.R.W.X”,
“http_status”: “200”,
“request_time”: “”,
“response_size”: “2689”,
“reference”: “A/25999/2019”,
“username”: “adae44955f0c8964658a1dc8c45b24b0”,
“type_consult”: “ajax”,
“http_method”: “GET”,
“url”: “/GT/xyz/proc/”,
“year”: “2019”,
“month”: “12”,
“day”: “31”,
“time”: “17:03:46”,
“timezone”: “+0100”,
“log_format”: “RHEL”
}
I would like to perform a LogQL query from “Explore” to display only the username for a specific reference (A/25999/2019). The log was sent raw with just a label that corresponds to the application name.
I try to use this request “{app_name=“web_access”} | json | json field=username as user | user != “” | count by user”
But I get this error message: parse error at line 1, col 47: syntax error: unexpected IDENTIFIER, expecting STRING
Do you have any idea what query to use to extract only the list of users?
Thank you