Numeric keys in LogQL


What is the best way to access numeric keys in the form of 150=6 or 150=8 from LogQL? It shows up properly in Parsed Fields but I am having difficulties using it in a query.

I only got it working by string matching |= “150=6” etc. but was hoping there might be another (better) way …

You can use functionality in Loki 2.0 to do this, you would need to parse the value out of the log line using one of the parser stages (regex, logfmt, json) but after this you can do stuff like:

{app="foo"} | regexp "(?P<number> some_regex_which_matches_the_number)" | number > 10

See the logql docs for some more info

Thanks, this is exactly what I ended up doing before reading your reply :+1:
To extend your example:

{app="foo"} | regexp "150=(?P<hundred_fifty>\d+)" | hundred_fifty = 6

Having said that, is there any difference performance-wise between string-queries (|= "150=6") and the above regexp parsing?

regexp is much slower, filter expressions like |= "150=6 are much faster.

json and logfmt parsers are faster than regexp also, if your logs are json already consider using | json instead of regexp

1 Like