Extracting fields from regex

Grafana Loki
1

Hello! I have log data that is a mix of JSON and unstructured data. I’d like to use regex to extract fields from this data.

For example, I’m using the following:

|~ \"method\":\"(?P<method>\w+)\"

Example log record:

INFO – : {“method”:“GET”,“path”:“/v1/api,“format”:”/",“status”:200}

Loki matches the row, but is not extracting the field.

I’m guessing I’m doing something simple wrong, but after quite a bit of trial and error and some G searches I still don’t have the answer.

Any help appreciated!

2

How about this?

{SELECTOR} | regexp "^([^:]*):(?P<JSON>.*)" | line_format "{{ .JSON }}" | json

Or see LogQL Analyzer | Grafana Loki documentation.

3

Thanks Tony for the reply. If I run the regex in isolation I am selecting the right content, but shouldn’t line_format “{{.JSON}}” output the matched regex group? It’s returning an empty string for some reason and this is causing the " | json " step to fail.

4

Yes, the JSON in the "{{ .JSON }}" part should match with the regex group name from the previous stage.

Try the log analyzer, and perhaps share a link so I can see why it’s not working for you.