How to query arrays in logs

Grafana Loki
1

Hi,

I don’t understand how I can access arrays in the logs. I read the documentation about the limitation of accessing arrays, but I am still struggeling.

This is an example json entry:

{
  "level": "info",
  "ts": 1742296189.212445,
  "logger": "http.log.access",
  "msg": "handled request",
  "request": {
    "remote_ip": "123.123.123.123",
    "remote_port": "38518",
    "client_ip": "64.252.77.126",
    "proto": "HTTP/1.1",
    "method": "GET",
    "host": "www.example.com",
    "uri": "/test/",
    "headers": {
      "User-Agent": [
        "Amazon CloudFront"
      ],
      "Accept-Encoding": [
        "gzip, deflate, br"
      ],
      "From": [
        "googlebot(at)googlebot.com"
      ]
    },
    "tls": {
      "resumed": false,
      "version": 771,
      "cipher_suite": 49195,
      "proto": "",
      "server_name": "www.example.com"
    }
  },
  "bytes_read": 0,
  "user_id": "",
  "duration": 0.130011116,
  "size": 9753,
  "status": 200,
  "resp_headers": {
    "Content-Type": [
      "text/html; charset=utf-8"
    ],
    "Cache-Control": [
      "public, max-age=300, stale-while-revalidate=300, stale-if-error=2592000"
    ],
    "X-Frame-Options": [
      "DENY"
    ],
    "Content-Encoding": [
      "gzip"
    ],
    "Vary": [
      "Cookie, Origin",
      "Accept-Encoding"
    ],
    "Server": [
      "Caddy",
      "gunicorn"
    ],
    "Alt-Svc": [
      "h3=\":443\"; ma=2592000"
    ],
    "Date": [
      "Tue, 18 Mar 2025 11:09:49 GMT"
    ]
  }
}

and this is my current query:

{container_name="/caddy-caddy-1",instance="caddy-caddy-1"} 
| json 
| line_format "{{.level}} {{.status}} {{ printf \"%-4s\" .request_method }} {{.request_host}} {{.request_uri}}"

How can I add the first entry of the Acces-Encoding array to my log entry? “gzip, deflate, br”
],

2

Just do json, and you’ll see all the parsed labels. For arrays I think they should up like Content-Type.0 (or something like that, I don’t remember exactly).

It’s not perfect, and you can’t really iterate through the arrays, but it’ll at least return something with an index.