Logql syntax error

Logql question, could not find a tag for it

I am totally new to Grafana/Loki/Prometheus/logql, frankly I am having a very difficult time figuring anything out.

But I have dragged it to this point. I have used promtail to bring in my apache access logs (albeit could not figure out pipeline stages, so am using apache piped logs to transform it and filter out).

I have a small set of log entries about 300.

For this exercise I want to just count how many 500 errors.

In grafana, I have setup a panel with logs display, using this logql

{job="apache_access"} | json | status = "500"

That displays in the log type display my entries.

So I switch to stat display and try to change it to:

count({job="apache_access"} | json | status = "500")

And it says: parse error at line 1, col 52: syntax error unexpected )

Count is a legit metric according to the logql manual, what am I doing wrong?


Hi @jlbprof ,

welcome to the Loki adventure :slight_smile:

It took some time to understand LogQL and I am by no means an expert… I tried a similar query to yours and got the same error. Seems like you can only use count on an other aggregation.

E.g. this worked for me


Than you for your reply.

count_over_time({job="apache_access"} | json | status == 500[30m])

Gets mucho errors related to json.




Has a lot of parsing errors. Am I only allowed to count over the entire list, and cannot pair it down?

Thank you

Not sure if I can help much more than that… One thing I can say is that the json parser will slow things down quite a bit and can report many parsing errors.


{my_label="my_label_value"} != "\"log.level\": \"INFO\""

will be much faster than this

{my_label="my_label_value"} | json  | log_level!="INFO"

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.