Facetting failed for filename

Grafana Configuration
1

Reading one file in grafana with promtail config file, It works fine for some time but after hour or so it gives the below error and I have to restart the instance again to rid of this error.

ERROR = “Facetting failed for {filename=”/var/log/tempdata2.log"}"
permission set for this file:
-rwxr-xr-x 1 ubuntu ubuntu 21375 Apr 9 13:07 tempdata2.log*

2

Hi there,

What does your query look like?

3

I also encountered the same problem during use, how can I solve it?
Snipaste_2021-06-02_16-42-03

4

Hi All,
the same here:
Facetting failed for {filename="/home/radek/slurm/array_171-5.log"}
It worked ~1hr after the job has been executed. After that I am unable to read logs and getting the error like above.
Any help most appreciated.

1 Like
5

The same error here, but for “job”, not for “filename” or “name”:
image

6

In my case, updating Fluentbit to 1.7.9 version (I’m collecting Windows Logs with Fluetbit and sending them to Loki) and restart the Fluentbit service solve the problem.

7

Hi, perhaps it is a good idea to try Fluent Bit instead of Promtail. Are you able to share your config file?

8

Hi @rd178639 ,

My config file of Fluentbit:

[SERVICE]
    Log_File     C:\Program Files\Graylog\sidecar\logs\fluentbit.log
    storage.path C:\Program Files\Graylog\sidecar\cache\fluentbit\data

[INPUT]
    Name         winlog
    Channels     Security,Windows PowerShell
    Interval_Sec 1
    DB           winlog.sqlite

[OUTPUT]
    name                   loki
    match                  *
    host                   lokiIP
    port                   3100
    labels                 job=${sidecar.nodeName}

I’m using Loki deployed on Kubernetes, and I’m doing the central management of the configuration of Fluentbit config files and services with Graylog Sidecar, all installed on the same Windows Server from where I’m collecting the Windows Logs.

Let me know if you need any additional information.

Regards,
Alejandro

9

Hey Alejandro,
thanks a lot for your config. Let me check if I can apply Fluentbit to my solution.

I already checked if downgrade Promtail version may help, but it’s the same issue as before. So, I will be checking Fluentbit with Loki.

Cheers,
Radek

10

Dear All,
It seemed that my issue was easy to fix by choosing the longer time period:
image
There is ‘last 1 hour’ set as default. Even though logs are available, they don’t appear. Try to change this to 7 days and then more logs should appear.
Have a nice week!
Cheers,
Radek

1 Like
11

I met this issue as well and sovled the issue the same as you did. So I am wondering if that is owning to there is no log generated during the last 1 hour and we have to set the query period longer than that?

12

That’s correct. The logs are older than 1hr and that’s the reason why you cannot see them and it also generates ‘facetting’ issue…
All the best,
Radek