Queries using patterns in Grafana -Loki

Grafana Loki
1

I’ve created several queries using nearly the same pattern. One query obtains all the data according to the filters configured and the second one, apart from the filters the one has, uses one extra condition: to obtain the data with a response time more or equal to 5.

The first query:
sum(count_over_time({environment=“PRO”, service=“OSB_ATM”} |~ \t([0-9]{1,}\.[0-9]{1,})\t | pattern <month> <day> <loki_hour> <server> <_>:<date> <time> <ip> <response_time> <method> <petid> <ws> <statusid> <size> [$__interval]))

The second query:
sum(count_over_time({environment=“PRO”, service=“OSB_ATM”} |~ \t([0-9]{1,}\.[0-9]{1,})\t | pattern <month> <day> <loki_hour> <server> <_>:<date> <time> <ip> <response_time> <method> <petid> <ws> <statusid> <size> | response_time >= 5 [$__interval]))

When I filter the time to 1 hour or less the result is consistent, that is; The first query always has to have more data than the second. The first query is global, and the second one only has the ones over 5.

But when I filter for more than three hours the result is not consistent. The second one has more results than the first one.
I’ve checked the query works correctly filtering in 15 minutes, and the data is OK. Why do the queries show this data for more time?
For 30 minutes:

image
image1727×433 75.9 KB

For 1 hour:

image
image1718×414 87.1 KB

For 3 hours and more these are the results:

image
image1704×432 59.2 KB

Las 24 hours:

image
image1726×423 42 KB

Is there something wrong with the query? Do I have to make the query differently?
Any idea about this behavior?

Regards

2

Apology if I am misreading something, but all your screenshots show consistent behaviors (left panel having more entries than right panel).

3

If what you’re saying is correct, then I don’t understand the numbres. I mean;
For the image “Last 3hours”.

  • Left pannel: 180K → One hundred and eighty thousand

  • Right pannel: 2.87K → The number would be Two thousand eight hundred and seventy?
    What I was undertanding is that 2.87k is two million eight hundred and seventy thousand. Is this my error understandind the values?

4

It is indeed a misunderstanding on your part. K = 1000, so 2.87 * 1000 = 2870, not 2 million.

You can also change the display mode to just number without the short hand representation, and see it that way.

5

OK! Thanks a lot and sorry for my misunderstanding