How to extract JSON properties with special characters in LogQL

[kyrumx]

I am using Serilog CompactJsonFormatter which yields JSON log messages. In this case, the level is found in the ‘@l’ property:

{"@t":"2016-06-07T03:44:57.8532799Z","@mt":"Hello, {User}","User":"nblumhardt","@l":"Debug"}

However, using LogQL, I find myself unable to do this with properties that have a ‘@’ in them:

{app="test"} | json level="@l" | level = `Error`

Giving me a cannot parse expression [@l]: syntax error: unexpected $end, expecting LSB or FIELD error.
I cannot simply escape it with ‘\’, as this will give me another error:
parse error at line 1, col 66: invalid char escape. Make sure that all special characters are escaped with \.

How do I properly parse the ‘@l’ JSON property into a label?

[davidallen5]

Hi! So you’ve got the right syntax and approach on extracting a JSON property, you’re just missing a bit more fancy escaping format needed there.

Instead of json level="@l" do this:

json level=`["@l"]`

the @ isn’t allowed in a label as it’s not in the list of valid characters for a Prometheus label, which are generally 0-9a-z-A-Z-_, so the extra escaping is necessary because of prometheus label restrictions, not json, is I think the case here.

I have created a link to a spot where you can play with this syntax and see that it works, which is within the LogQL query analyzer documentation.

LogQL Analyzer | Grafana Loki documentation

[kyrumx]

Cheers! This is exactly what I was looking for.