Performing time series counts over json loki query with LogQL

We have a cookie-consent.log which stores the cookie as a json file in a log file. I want to be able to parse trends over time to see how many people have accepted or denied the cookies.

I got close but am struggling with defining the appropriate sum and count_over_time. I think I just lack an understanding of how to do this.

Can someone point me in the right direction?

Here is a sample of the log:

[2024-01-10 16:45:40] YsCookieConsent.INFO: 2024-01-10 16:45:40: Mozilla/5.0 (iPhone; CPU iPhone OS 17_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:45:47] YsCookieConsent.INFO: 2024-01-10 16:45:47: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":false,"google_ads":false,"google_tag_manager":false,"facebook":false,"onlinesizer":true,"twak":false,"microsoft_uet":false,"youtube":true} [] []
[2024-01-10 16:46:46] YsCookieConsent.INFO: 2024-01-10 16:46:46: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":false,"google_ads":false,"google_tag_manager":false,"facebook":false,"onlinesizer":true,"twak":false,"microsoft_uet":false,"youtube":true} [] []
[2024-01-10 16:47:05] YsCookieConsent.INFO: 2024-01-10 16:47:05: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.1 Mobile/15E148 Safari/604.1 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:48:04] YsCookieConsent.INFO: 2024-01-10 16:48:04: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:48:04] YsCookieConsent.INFO: 2024-01-10 16:48:04: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:48:13] YsCookieConsent.INFO: 2024-01-10 16:48:13: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:48:19] YsCookieConsent.INFO: 2024-01-10 16:48:19: Mozilla/5.0 (Linux; Android 13; SM-A037G Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/120.0.6099.145 Mobile Safari/537.36 Instagram 312.1.0.34.111 Android (33/13; 300dpi; 720x1465; samsung; SM-A037G; a03s; mt6765; de_AT; 548323749) - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:48:35] YsCookieConsent.INFO: 2024-01-10 16:48:35: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":true,"google_ads":true,"google_tag_manager":true,"facebook":true,"onlinesizer":true,"twak":true,"microsoft_uet":true,"youtube":true} [] []
[2024-01-10 16:48:50] YsCookieConsent.INFO: 2024-01-10 16:48:50: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 - {"oxid":true,"trustedshops":true,"amazon":true,"google_analytics":false,"google_ads":false,"google_tag_manager":false,"facebook":false,"onlinesizer":true,"twak":false,"microsoft_uet":false,"youtube":true} [] []

This is the LogQL I used to generate the first panel. But I think this is wrong because the time series/count over time seems off?

sum(count_over_time({host="example.com", job="ys_cookie_consent"} | regexp `(?P<cookie>{(.*)})` | line_format `{{ .cookie }}` | json | drop cookie [1h]))