How to correctly edit logs

Hello,

I want to visualize my logs, i successfully managed to send them to loki, but now loki shows this error when i try to see them with log labels - filename, it says this:

Error: parse error at line 1, col 11: invalid char escape . Make sure that all special characters are escaped with . For more information on escaping of special characters visit LogQL documentation at LogQL | Grafana Labs.

Heres example of one line from my logs:

43790,2021-01-31,22:32:24,57,21
I suppose first step is that i will have to change this to this:
cu=43790 t=2021-01-31T22:32:24 u=57 h=21
but what is wrong with this log?

Thank you for your answers.
With best reagrds,
Oto Weinlich

Could you please share your loki query? Also, you can check out this issue/thread with more information on loki escaping: Explore errored when label contains unescaped "\" · Issue #20869 · grafana/grafana · GitHub

My loki query was that i though that the error was in the way my logs were writen in, but it looks like there is something wrong with the way how log label is writen -
(i found in grafana folders some test logs (i guess), even those corecctly written logs will have the same error)

In my promtail-local-config.yaml is writen: path: C:\var\log\*txt

Then i locally run promtail with this command - .\promtail-windows-amd64.exe --config.file=promtail-local-config.yaml

Then on community.grafana.com i see that the logs were successfully delivered but when i try to see logs labels through path that is writen for example like this: {filename=“C:\var\log\02-02-21_data.txt”}, it says this error:

Error: parse error at line 1, col 11: invalid char escape . Make sure that all special characters are escaped with . For more information on escaping of special characters visit LogQL documentation at LogQL | Grafana Labs.

With the link that you provided (thank you), i found that writing the command like this:
{filename=“C:\\var\\log\\02-02-21_data.txt”} what should do the trick, but then i just wont load and all i see is spinning wheel with “cancel” writen next to it.

I have tested it locally and {filename=“C:\\var\\log\\02-02-21_data.txt”} worked for me.

Could you maybe check the network tab? Or wait longer? Because the fact that it is loading means that the query was send to loki and is waiting for the response.

When i tried to wait a bit longer, nothing was happening, so i decided to just restart my local instance of loki and promtail, but now i can see that promtail is sending logs, i updated the data source, but cant see any log labels.

Problem was that the time set to be 5mins which was too little, overtimed it to 7 days, now is everthing fine, even logs are showing up, thank you for your support.

1 Like

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.