Extract a list of usernames (without the rest of the log) from a JSON log


I have a log in the following format in Loki:

“ip_addr”: “T.R.W.X”,
“http_status”: “200”,
“request_time”: “”,
“response_size”: “2689”,
“reference”: “A/25999/2019”,
“username”: “adae44955f0c8964658a1dc8c45b24b0”,
“type_consult”: “ajax”,
“http_method”: “GET”,
“url”: “/GT/xyz/proc/”,
“year”: “2019”,
“month”: “12”,
“day”: “31”,
“time”: “17:03:46”,
“timezone”: “+0100”,
“log_format”: “RHEL”

I would like to perform a LogQL query from “Explore” to display only the username for a specific reference (A/25999/2019). The log was sent raw with just a label that corresponds to the application name.

I try to use this request “{app_name=“web_access”} | json | json field=username as user | user != “” | count by user”

But I get this error message: parse error at line 1, col 47: syntax error: unexpected IDENTIFIER, expecting STRING

Do you have any idea what query to use to extract only the list of users?

Thank you :slight_smile:


  | json
  | reference = "A/25999/2019"
  | line_format "{{ .username }}"

Thank you very much !!! And I want print a second colonne with the date / time, how can I do it ?
Big thanks for your help !

You can add multiple fields to line_format like line_format "{{.username}} {{.year}}"