Histogram-like representation as in explore

[sandrodentella]

Whn exploring logs with explorer loki uses a great graphical representation along with logs:

In the image i’s related to cronjobs so that they are separated and I can spot immediately the job they refer to.

When I apply I only see the logs, not the graphical part, is it possible to get both exactly as in the explorer?

[sandrodentella]

I try to better formulate my question/need.

I guess I can obtain this representation by using 2 different panels, one with logs the other with a metric query. I have not been able to obtain the same representation:

• Log panel already detects which log entry is an error and shows it in red but I’ve no labels to “sum by” the level to stack them as in the image

• is it possible to know which query has been used to get that graph? is it a combination of parsing and labeling or is there something easier?

the query I have started with is

count_over_time({job="run-jobs-django"}) 

I guess if I could parse the line and add a label on the level I could get close to what is used in the default explorer’s graph.

[tarrantro]

Hi Sandro,

I don’t see there is an option to use one panel to show both graph and logs. You can use a dashboard with both to get what you need.

For your query:

1. If you need to stack some errors or keywords from logs, and you didn’t scrap it from rpomtail config. You will need to parse it. For example, I need to scrap my 404 error from my django log and my log is json. Like below:

{"message": "Not Found: /static/admin/css/responsive.css", "status_code": 404, "request": "<WSGIRequest: GET '/static/admin/css/responsive.css'>"}

{"message": "127.0.0.1 - - [02/May/2022:09:38:31 +0000] \"GET /static/admin/css/responsive.css HTTP/1.1\" 404 179 \"http://127.0.0.1:8000/admin/login/?next=/admin/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "127.0.0.1 - - [02/May/2022:11:57:55 +0000] \"GET /admin/ HTTP/1.1\" 302 0 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "127.0.0.1 - - [02/May/2022:11:57:55 +0000] \"GET /admin/login/?next=/admin/ HTTP/1.1\" 200 1913 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "Not Found: /static/admin/css/login.css", "status_code": 404, "request": "<WSGIRequest: GET '/static/admin/css/login.css'>"}

{"message": "127.0.0.1 - - [02/May/2022:11:57:55 +0000] \"GET /static/admin/css/login.css HTTP/1.1\" 404 179 \"http://127.0.0.1:8000/admin/login/?next=/admin/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "Not Found: /static/admin/css/base.css", "status_code": 404, "request": "<WSGIRequest: GET '/static/admin/css/base.css'>"}

{"message": "127.0.0.1 - - [02/May/2022:11:57:55 +0000] \"GET /static/admin/css/base.css HTTP/1.1\" 404 179 \"http://127.0.0.1:8000/admin/login/?next=/admin/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "Not Found: /static/admin/css/responsive.css", "status_code": 404, "request": "<WSGIRequest: GET '/static/admin/css/responsive.css'>"}

{"message": "127.0.0.1 - - [02/May/2022:11:57:55 +0000] \"GET /static/admin/css/responsive.css HTTP/1.1\" 404 179 \"http://127.0.0.1:8000/admin/login/?next=/admin/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "Not Found: /", "status_code": 404, "request": "<WSGIRequest: GET '/'>"}

{"message": "127.0.0.1 - - [02/May/2022:11:57:59 +0000] \"GET / HTTP/1.1\" 404 179 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

{"message": "Not Found: /", "status_code": 404, "request": "<WSGIRequest: GET '/'>"}

{"message": "127.0.0.1 - - [02/May/2022:11:58:18 +0000] \"GET / HTTP/1.1\" 404 179 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36\""}

I can use below query:

count_over_time({app="django"}[1h]|json|status_code= 404)

2. The graph will be generate via the query, if you want to know the query, should be in datasource.

[sandrodentella]

Thanks @tarrantro,

@tarrantro

count_over_time({app=“django”}[1h]|json|status_code= 404)

would just show the errors, not the normal / unknown as in the image you get in explore.

It’s already a pity that the already existing widget they use in explorer is not available, but, IIUC, what you suggest would just be a partial solution. Correct?

[yosiasz]

Could you please provide some sample json data? I don’t see why this should not be possible with your basic time series plugin?

[tarrantro]

In your image, I can only see logs with stdout or stderr, you can grep the keywords in query or parse your log as json for better view.
And in your image, there is a column graph and I assume you are going to visualize as the same graph, not widget. But you can switch the graph to widget if you need.

[tarrantro]

I’m using this query to parse the query and it will group the bar by status code. You can refer to this example. log still the same as I posted.

sum by (status)(count_over_time({app=“django”}[1h]|json| line_format “{{.message}}”|pattern “ - - [] " " "-" "" <_>”|status!=“”))