How to filter sql server log

[alencappelletti]

Hi all I try to filter SQL SERVER log…
It’s my first time with LOKI…

I seem to have understood that maybe I need to create some sort of mapping for the labels from the log file … but the SQL SERVER, apart from the date, doesn’t have a real composition of fields.

I’d like to filter on a word, but opening any line in detail I don’t see any label value.
How should I proceed then?

How can I filter for a given word, for example {job = “sqlserver”} | = “memory”?
Can I do it online? Or do I need to remap the file in a pipeline_stages?

• job_name: sqlserver
  pipeline_stages:
  - regex:
  expression: “^(?P\S+) (?P\S+) (?P\S+) \[(?P[\w:/]+\s[+\-]\d{4})\] "(?P\S+)\s?(?P\S+)?\s?(?P\S+)?" (?P<status_code>\d{3}|-) (?P\d+|-)\s?"?(?P[^"])"?\s?"?(?P[^"])?"?$”

[tonyswumac]

First I’d recommend reading through the documentation if you haven’t: Log queries | Grafana Loki documentation

To answer your question, if all you are looking for is a particular string you can just use stream selector directly after label filter, think of it like grep. Your example {job = "sqlserver"} |= "memory" will work just fine, and you can even add more phrases to the selector to be more specific.

Pattern parsing is only useful for structured log and if you are looking for a specific property of the log.