Logcli query appears broken to me

Grafana Loki
,
1

First I do a fairly crude search for errors from one application (using cut to reduce line length):

$ logcli --addr=“``http://172.16.255.18:3100/”`` query --from=“2025-08-14T16:00:00Z” --to=“2025-08-28T00:00:00Z” --limit=2 '{app=“Rabbit”} |= “Address format errors” ’ | cut -c-170
2025/08/15 10:54:37 ``http://172.16.255.18:3100/loki/api/v1/query_range?direction=BACKWARD&end=1756339200000000000&limit=2&query={app%3D"Rabbit"}+|%3D+“Address+format+errors”+&start=1755187200000000000
2025/08/15 10:54:37 Common labels: {app=“Rabbit”, channel=“Rabbit”, detected_level=“error”, host=“Rabbit”, service_name=“Rabbit”}
2025-08-15T03:08:07+10:00 {} {“message”:“Address format errors”,“level”:400,“level_name”:“ERROR”,“channel”:“Rabbit”,“datetime”:“2025-08-15T03:08:07.209321+10:00”,"ctxt_pa
2025-08-15T03:08:05+10:00 {} {“message”:“Address format errors”,“level”:400,“level_name”:“ERROR”,“channel”:“Rabbit”,“datetime”:“2025-08-15T03:08:05.383036+10:00”,"ctxt_pa

Since those both have the label detected_level=”error”, I would expect to find them with:

$ logcli --addr=“``http://172.16.255.18:3100/”`` query --from=“2025-08-14T16:00:00Z” --to=“2025-08-28T00:00:00Z” --limit=2 '{app=“Rabbit”, detected_level=“error”} |= “Address format errors” ’ | cut -c-170
2025/08/15 10:56:55 ``http://172.16.255.18:3100/loki/api/v1/query_range?direction=BACKWARD&end=1756339200000000000&limit=2&query={app%3D"Rabbit"%2C+detected_level%3D"error"}+|%3D+“Address+format+errors”+&start=1755187200000000000

but that query returns no output. Why does adding the second label criterion cause the search to return nothing, when both results from the first search have that label value?

Loki 3.3.0-r5 running in an Alpine LXC on Proxmox.

2

Not sure I understand. What exactly did your first query return? Can you put a bit of separation between them? And show the whole return results, please.

3

@mounty detected_level is probably metadata, not a label.

Try querying it like this:

{service_name="grafanacon-json-otel"} | detected_level="warn"

4

Thank you. That’s it. I didn’t understand that’s how Loki works.