Hello Team:
I was requested to build a Grafana panel showing a list of the top 5 hosts sending syslog messages to Loki in a period of time.
The best I could achieve is shown in the following image: it shows a list of ALL the hosts sending logs in a period of time, but I do not know if I can (1) limit the display to the hosts with the 5 biggest results and (2) do this in an ordered way
Can you post a new screenshot on your graph? Just want to confirm that topk actually works for you in terms of returning only the top X results.
In terms of sorting, I don’t actually know if LogQL supports sorting yet. But you can just let Grafana Table panel takes care of that for you by clicking on the column header:
This is the output with topk included. Now I see host Q-001 then A-001 then Q-012 and so on. The order of hosts has been altered as well as the numbers on the righthand side (in the original output Q-001 was 12 now Q-001 is 5):
In my panel I do not see a column header from which to order the results as you show in your image. ¿ is that a feature I need to activate in the visualization options?
I’d encourage you to take a look at the Nginx dashboard on grafana playground, I copied some of my graphs from there and there are many other outstanding dashboards there that you’ll no doubt get some ideas from.
That said, if you’d like, give me some of your actual log lines (doesn’t need to be real, just the structure). I’ll put it in my Loki cluster and see what I can do.
The aforementioned URL says that “… $__interval is supported, but this returns more results than the limit set in the topK, which is correct but counter-intuitive and not what is needed by the user. …”
I will have to work this out for a long time I believe…
I do not understand the numbers I get in the output. None of these hosts are sending 100K logs in 5 minutes. At most one per second. Each bar should show something well below 300.
I do not know which operation is being carried out and shown in the righthand side of each bar.
The “Calculation” parameter in the Visualization column is influencing the number in the output. I was using “Total” and the output was those wierd numbers. I changed to “Last” and now the numbers are more correlated with the pace of logs being sent by these devices…
Yes, it’s important to be mindful of the nature of the data you are trying to get.
In this case, you are trying to get an aggregated view of count over a period of time, so you don’t actually need a time series data. So you want to:
Make sure in query option you set it to return 1 data point only.
Change query type to instant instead of range.
Make sure to use $__auto in your query interval.
And if you have a table dashboard, use transformation to hide timestamp, and set the colume that shows number to the type of gauge, then you’ll get a nice presentation like my screenshot above.
sorry i fogot example:
{“message”:"this is message, “New_key”: {“key1”: “value1”, “key2”: “value2”}}}
i want send new field “New_key”: {“key1”: “value1”, “key2”: “value2”}} then loki can using this json make field as label
In my case I use Promtail to get the logs from network devices (actually, I need to have Syslog-NG between the devices and Promtail). And it is within Promtail whereby I detect the patterns and create labels.
This is a piece of Promtail´s configuration that I managed to tune in order to add as many labels to my logs as needed for processing in Loki; please see the “regex” and “labels” stanzas:
