The problem is exactly the timestamp; it is extracted from the query (with:
… | label_format ts={{.date}}T{{.time}}
but It is “string” and not timestamp.
In other words, as shown In the image below, I need to use my ts value (“B” selection) instead of the default value (“A” selection); “B” is timestamp into my log files, “A” is the timestamp of line inserted into the Loki.
I think you should look to fix the timestamp issue during log ingestion. From your log agent, you should do minimum parsing necessary to get the timestamp so your logs can be sent to Loki with the correct timestamp instead of the timestamp of the log ingestion.
That is the approach I’d take. Otherwise you are stuck trying to manipulate query which I don’t think should be something that you (or any of your user) should have to worry about when querying for logs.