How to find messages which are truncated by size?

Hello, we have default size for maximum message size

max_line_size: 128kb

and in exported metrics I see constant rate of:

loki_mutated_samples_total{reason="line_too_long"}

How can I find events with long lines?
I’ve read all the PromQL documentation and only came up with:

{cluster="eks-af-south-1"} |~".{1000,}"

which returns events >1k in size. But there are too many of such events, and it is the maximum regex value, so I cannot make it ".{100000,}" as it is the syntax error.
What are my options in searching for events which are getting truncated?
Thanks

1 Like

Found another option:
https://grafana.com/blog/2022/05/12/10-things-you-didnt-know-about-logql/#2-you-can-count-the-length-of-extracted-values

{cluster="eks-af-south-1"} | label_format len=`{{ __line__ | len }}` | len > 10000

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.