Merge 2 Queries to Include Both Data in an Alert

[teddybear13tb]

In Grafana cloud, I am using Loki in the alerts, to extract exceptions of the jobs from the logs.
Following the query that would extract the exception:

count_over_time({namespace=“data-services”, cluster=“p21d”, job=~“data-services/abc.*”} |~ (?i)exception | pattern <exception> [500h])

Following an example of the generated alert:

I have another query where it extracts the tenant:

count_over_time({namespace=“data-services”, cluster=“p21d”, job=~“data-services/abc.*”} |~
tenant '.*' | pattern `<_> tenant ‘’` [500h])

The tenant and the exception are not in the same log line, each one is in a different line.

I’m looking to include both the tenant and exception information in the same query so that I can extract the tenant and the exception in the alert would be more informative. However, since the tenant and exception are logged on separate lines, I’m currently unable to achieve this with a single Loki query.

Any advice or workarounds would be greatly appreciated.

[tonyswumac]

Can you provide an example of your original logs?

If your tenant information is on a separate line, perhaps you could consider using multi-line logs so you have all the information you need in one line?