I read that as few as possible should be indexed with Loki, that means in the examples I’ve seen that only the origin of the log file is indexed.
Is this correct?
I wonder if it would also increase the performance if I index json fields like log level or even logger name.
Is there a rule of thumb what should be indexed?
Maybe it is also wrong to index a json field at all?
This is the best practice doc for labels: Best practices | Grafana Loki documentation
In Loki, only the labels are indexed. So your instinct is right that the smaller the potential values are for a label the better it is. But really the key is this:
Label values must always be bounded .
We do have labels that have hundreds of values (like EC2 instance ID for example), and it hasn’t really been a problem for us. From your example, I’d say both log level and logger name would be just fine for labels.