# How do i graph loki data on geomap?

**URL:** <https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732>\
**Category:** Grafana Loki\
**Tags:** geomap-panel, docker, loki, query-help\
**Created:** [September 23, 2024, 3:22pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732 "2024-09-23T15:22:56Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 23, 2024, 3:22pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/1 "2024-09-23T15:22:56Z")

</div>

I am struggling with creating visualization from container logs from loki on geomap in grafana

here is logs from the container from explore loki to show the data we want to use for the dashboard

> {“time\_local”: “23/Sep/2024:14:08:48 +0000”, “remote\_addr”: “4300:1200:2050:6050:7098:e236:5997:e734”, “request”: “GET /test HTTP/1.1”, “status”: “200”, “body\_bytes\_sent”: “840”, “http\_referer”: “[https://example.com](https://example.com)”, “http\_user\_agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36”, “country\_code”: “US”, “country”: “United States”, “city”: “Chicago”, “postal\_code”: “60602”, “timezone”: “America/Chicago”, “lat”: “19.64200”, “lon”: “-57.34300”}

when i run the following query on basic logs i see the following

`query`

> {container=“trading-app”} | json | line\_format “{{.lat}},{{.lon}},{{.city}},{{.country}}”

`result`

> 19.64200, -57.34300, Chicago, United States

so now when i try to run this query on geomap , nothing is showing up on the map and i also get this error in the panel and have no idea what to do

`query`

> {container=“trading-app”} | json | line\_format “{{.lat}},{{.lon}}”

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/d/6/d6db65a0b09b1c31fdc9154c773314ac9b894493.png)

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/f/a/fa3d98b26f9b65232dc3edca29a5b172892fc8ce.png)

so please help what am i missing to graph loki data properly on geomap

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [September 23, 2024, 3:59pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/2 "2024-09-23T15:59:49Z")

</div>

Two problems I see:

1. The lon/lat fields need to be made into labels.
2. Your query is not a metrics query.

Try this (i am using count because I assume you want to see number of connections based on coordinates):

```auto
sum by (lat,lon) (
  count_over_time({container="trading-app"} | json [$__auto])
)

```

> Edit: originally I did `| json | label_format lat="{{ .lat }}",lon="{{ .lon }}"`, but now that I think about it I don’t think you need to do that. The json filter should take care of that for you.

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 23, 2024, 4:07pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/3 "2024-09-23T16:07:58Z")

</div>

here is error i got when i used your query

> sum by (lat,lon) (  
> count\_over\_time({container=“trading-app”} | json | label\_format lat=`{{ .lat }}`,lon=`{{ .lon }}` [$\_\_auto])  
> )

```auto
pipeline error: 'JSONParserErr' for series: '{ __error__ ="JSONParserErr", __error_details__ ="Value looks like object, but can't find closing '}' symbol", container="trading-app", job="containerlogs", lat="", logstream="stderr", lon=""}'. Use a label filter to intentionally skip this error. (e.g | __error__!="JSONParserErr"). To skip all potential errors you can match empty errors.(e.g __error__ ="") The label filter can also be specified after unwrap. (e.g | unwrap latency | __error__ ="" )

```

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/8/6/861c2563ea6d4b042434cf7dba4f09696efb8667.png)

> sum by (lat,lon) (  
> count\_over\_time({container=“trading-app”} | json [$\_\_auto])  
> )

```auto
pipeline error: 'JSONParserErr' for series: '{ __error__ ="JSONParserErr", __error_details__ ="Value looks like object, but can't find closing '}' symbol", container="trading-app", job="containerlogs", logstream="stderr"}'. Use a label filter to intentionally skip this error. (e.g | __error__!="JSONParserErr"). To skip all potential errors you can match empty errors.(e.g __error__ ="") The label filter can also be specified after unwrap. (e.g | unwrap latency | __error__ ="" )

```

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/d/4/d478d908183a11359c07e08dedb9052e0bc44104.png)

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [September 23, 2024, 8:25pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/4 "2024-09-23T20:25:21Z")

</div>

Error is quite clear, your logs aren’t in json format. Can you post an example line of your logs, please?

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 23, 2024, 8:27pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/5 "2024-09-23T20:27:51Z")

</div>

logs from the grafana container

```auto
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=Loki dsUID=c90f4191-21f6-4a3b-8357-313ee5c15ae3 uname=admin fromAlert=false t=2024-09-23T19:59:59.538163391Z level=error msg="Error received from Loki" duration=6.899217ms stage=databaseRequest statusCode=400 contentLength=494 start=2024-09-23T07:59:59.295Z end=2024-09-23T19:59:59.295Z step=1m0s query="sum by (lat,lon) (\n count_over_time({container=\"trading-app\"} | json | label_format lat=`{{ .lat }}`,lon=`{{ .lon }}` [1m])\n)" queryType=range direction=backward maxLines=1000 supportingQueryType=none lokiHost=loki:3100 lokiPath=/loki/api/v1/query_range status=error error="pipeline error: 'JSONParserErr' for series: '{ __error__ =\"JSONParserErr\", __error_details__ =\"Value looks like object, but can't find closing '}' symbol\", container=\"trading-app\", job=\"containerlogs\", lat=\"\", logstream=\"stderr\", lon=\"\"}'.\nUse a label filter to intentionally skip this error. (e.g | __error__!=\"JSONParserErr\").\nTo skip all potential errors you can match empty errors.(e.g __error__ =\"\")\nThe label filter can also be specified after unwrap. (e.g | unwrap latency | __error__ =\"\" )\n\n"
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=Loki dsUID=c90f4191-21f6-4a3b-8357-313ee5c15ae3 uname=admin fromAlert=false t=2024-09-23T19:59:59.538245383Z level=error msg="Error querying loki" error="pipeline error: 'JSONParserErr' for series: '{ __error__ =\"JSONParserErr\", __error_details__ =\"Value looks like object, but can't find closing '}' symbol\", container=\"trading-app\", job=\"containerlogs\", lat=\"\", logstream=\"stderr\", lon=\"\"}'.\nUse a label filter to intentionally skip this error. (e.g | __error__!=\"JSONParserErr\").\nTo skip all potential errors you can match empty errors.(e.g __error__ =\"\")\nThe label filter can also be specified after unwrap. (e.g | unwrap latency | __error__ =\"\" )\n\n"
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=Loki dsUID=c90f4191-21f6-4a3b-8357-313ee5c15ae3 uname=admin fromAlert=false t=2024-09-23T20:26:52.144643097Z level=error msg="Error received from Loki" duration=8.110675ms stage=databaseRequest statusCode=400 contentLength=494 start=2024-09-23T08:26:51.943Z end=2024-09-23T20:26:51.944Z step=1m0s query="sum by (lat,lon) (\n count_over_time({container=\"trading-app\"} | json | label_format lat=`{{ .lat }}`,lon=`{{ .lon }}` [1m])\n)" queryType=range direction=backward maxLines=1000 supportingQueryType=none lokiHost=loki:3100 lokiPath=/loki/api/v1/query_range status=error error="pipeline error: 'JSONParserErr' for series: '{ __error__ =\"JSONParserErr\", __error_details__ =\"Value looks like object, but can't find closing '}' symbol\", container=\"trading-app\", job=\"containerlogs\", lat=\"\", logstream=\"stderr\", lon=\"\"}'.\nUse a label filter to intentionally skip this error. (e.g | __error__!=\"JSONParserErr\").\nTo skip all potential errors you can match empty errors.(e.g __error__ =\"\")\nThe label filter can also be specified after unwrap. (e.g | unwrap latency | __error__ =\"\" )\n\n"
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=Loki dsUID=c90f4191-21f6-4a3b-8357-313ee5c15ae3 uname=admin fromAlert=false t=2024-09-23T20:26:52.144746455Z level=error msg="Error querying loki" error="pipeline error: 'JSONParserErr' for series: '{ __error__ =\"JSONParserErr\", __error_details__ =\"Value looks like object, but can't find closing '}' symbol\", container=\"trading-app\", job=\"containerlogs\", lat=\"\", logstream=\"stderr\", lon=\"\"}'.\nUse a label filter to intentionally skip this error. (e.g | __error__!=\"JSONParserErr\").\nTo skip all potential errors you can match empty errors.(e.g __error__ =\"\")\nThe label filter can also be specified after unwrap. (e.g | unwrap latency | __error__ =\"\" )\n\n"

```

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [September 23, 2024, 8:32pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/6 "2024-09-23T20:32:15Z")

</div>

No, I meant a sample of your actual logs, so we can see if it’s JSON or not.

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 23, 2024, 8:33pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/7 "2024-09-23T20:33:49Z")

</div>

you mean the app logs we want to visualize on geomap?

i have it on the very first post of the thread

here is the log format and it is in json format

> {“time\_local”: “23/Sep/2024:14:08:48 +0000”, “remote\_addr”: “4300:1200:2050:6050:7098:e236:5997:e734”, “request”: “GET /test HTTP/1.1”, “status”: “200”, “body\_bytes\_sent”: “840”, “http\_referer”: “[https://example.com](https://example.com)”, “http\_user\_agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36”, “country\_code”: “US”, “country”: “United States”, “city”: “Chicago”, “postal\_code”: “60602”, “timezone”: “America/Chicago”, “lat”: “19.64200”, “lon”: “-57.34300”}

remember this is logs from container which am using to grab using lables on the container apps

the above log is pulled from the loki explore output of the container. i explained this in very first post above

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [September 23, 2024, 9:30pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/8 "2024-09-23T21:30:06Z")

</div>

Does your log actually pass the json filter? For example, if you just do `{container="trading-app"} | json` does it work?

Your example appears to be proper JSON, except that the quotation mark isn’t ascii, which could happen from copy pasting. But if it’s actually that way in your logs then you won’t be able to parse with JSON filter, then you’d have to look at using regex.

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 23, 2024, 9:33pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/9 "2024-09-23T21:33:51Z")

</div>

did you read my very first post?

i have a query with that in it and the result

actually i think i know what the issue is, so some of the logs are not in json format, and but it is able to detect the lines that are in json format

so seems i need to hide or remove the log lines that are should not be included in the query

below is screenshot showing the lines that are not in the json format we want

`query`

> {container=“trading-app”} | json | line\_format “{{.lat}},{{.lon}},{{.city}},{{.country}}”

`result`

> 19.64200, -57.34300, Chicago, United States  
> 19.64200, -57.34300, Chicago, United States  
> 19.64200, -57.34300, Chicago, United States

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/b/5/b5d0bfeb39ea3afc80ff61bf9a69c0d81f170bef.png)

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 23, 2024, 11:13pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/10 "2024-09-23T23:13:49Z")

</div>

i figured the issue with the query errors, i removed the log lines that are not in same format and now getting closer

so here is the updated query now

> sum by (lat, lon) (  
> count\_over\_time({container=“trading-app”}  
> | json  
> | lat != “” and lon != “” [$\_\_auto])  
> )

now i still dont see anything on geomap but when i switched to table then i see the query output

so what is still going on with geomap?

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/4/3/432216a682ed26061d8dad81f58ddc4e09a24bf8.png)

here is the table log type showing query result

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/8/f/8f7d2b0035a403f46b5cea5c598f4d51a6dbcc0b.png)

---

<div class="post-metadata">

**Author:** ![solitcon](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@solitcon](https://community.grafana.com/u/solitcon)\
**Post date:** [September 25, 2024, 9:37pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/11 "2024-09-25T21:37:26Z")

</div>

what do you see when you clixk on the Table View

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 26, 2024, 5:05pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/12 "2024-09-26T17:05:55Z")

</div>

i put the screenshot in my last reply above

also posting here again

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/4/3/432216a682ed26061d8dad81f58ddc4e09a24bf8.png)

---

<div class="post-metadata">

**Author:** ![yosiasz](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/yosiasz/32/45847_2.png) [@yosiasz](https://community.grafana.com/u/yosiasz)\
**Post date:** [September 26, 2024, 5:24pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/13 "2024-09-26T17:24:00Z")

</div>

so your data needs to be in the format

```auto
time, lat,lon,value
2024-09-23,1,6.44,3.39030,1

```

right now it is

```auto
time,{lat="6.44",lon="3.39030"}
2024-09-23,1

```

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 26, 2024, 6:36pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/14 "2024-09-26T18:36:34Z")

</div>

So what query do i need to get to the right format?  
that is why i am requesting help

thanks

also you last response seems to contain some typo

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [September 28, 2024, 10:19am UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/15 "2024-09-28T10:19:55Z")

</div>

anyone willing to help with this geomap query?

will appreciate your help

---

<div class="post-metadata">

**Author:** ![yosiasz](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/yosiasz/32/45847_2.png) [@yosiasz](https://community.grafana.com/u/yosiasz)\
**Post date:** [September 29, 2024, 6:57pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/16 "2024-09-29T18:57:40Z")

</div>

> [@encryptblockr](#):
>
> **also you last** response seems to contain some typo

which post are you referring to?

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [October 5, 2024, 2:12am UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/17 "2024-10-05T02:12:37Z")

</div>

> [@yosiasz](#):
>
> which post are you referring to?

i said your last response which means the response you made last before that comment

i find that i repeat myself many times not sure if you guys read the posts i make

i have posted all screenshots and queries tried and all but i get questions about things i posted already above

---

<div class="post-metadata">

**Author:** ![solitcon](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@solitcon](https://community.grafana.com/u/solitcon)\
**Post date:** [October 7, 2024, 2:50pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/18 "2024-10-07T14:50:25Z")

</div>

which typo?

---

<div class="post-metadata">

**Author:** ![encryptblockr](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@encryptblockr](https://community.grafana.com/u/encryptblockr)\
**Post date:** [October 7, 2024, 3:05pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/19 "2024-10-07T15:05:48Z")

</div>

do you see typo here?

```auto
time, lat,lon,value
2024-09-23,1,6.44,3.39030,1

```

 ![image](https://us1.discourse-cdn.com/grafana/original/3X/4/d/4dd97d12a5510e1c0fc8e6cbbe7554b6a6e9b6e6.png)

---

<div class="post-metadata">

**Author:** ![solitcon](https://avatars.discourse-cdn.com/v4/letter/s/8e7dd6/32.png) [@solitcon](https://community.grafana.com/u/solitcon)\
**Post date:** [October 7, 2024, 4:22pm UTC](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732/20 "2024-10-07T16:22:18Z")

</div>

ah got it now. extra data there  
but the typo is not an issue, not sure why you are fixated on that

[Next page](https://community.grafana.com/t/how-do-i-graph-loki-data-on-geomap/132732.md?page=2)