The pattern does not show what I need

Grafana Loki
1

Good afternoon,

I have problems/questions with the grafana-loki patterns.

I have the following log line:

Aug 5 15:00:41 server server_log: 2024-08-05 15:00:25 10.51.81.5 5.446 POST petID WS 200 “OK” 918 “ip_client”

I currently have the following pattern configured:

pattern <month> <day> <loki_hour> <server> <_>:<date> <time> <ip> <response_time> <method> <petid> <ws> <statusid> <size>

Currently the size appears: 200 “OK” 918 “ip_client”

I need to get the ip_client.

I have tried to modify the pattern in the following way:

pattern <month> <day> <loki_hour> <server> <_>:<date> <time> <ip> <response_time> <method> <petid> <ws> <statusid> "<status>" <size> "<client>"

But not all the “variables” appear, the status variable appears in the following way:
OK" 960 “ip_client”

What am I doing wrong? How do I do it correctly?

Thank you very much,

2

I don’t see anything wrong wit your pattern. Couple of things I’d suggest:

  1. Make sure the double quote in your logs are the ascii version, not the windows version.

  2. You can exclude double quote in your pattern and see if that works better.

3

First of all, thanks for your quick response.

1- I also tried to copy-paste the double quotes, so as not to enter them manually. How can I see/know which version the text of the quotes is in?

2- I also tried to exclude the double quotes and it still doesn’t take the “variables” that I put in the pattern.

Can you think of anything else?

Thanks again,

4

Usually the windows version of double quotes are slightly curled.

Can you put your logs in this tool, as well as your pattern query, and share the link please? LogQL Analyzer | Grafana Loki documentation

5

Hi,

I finally solved it. The problem is the tab stop between the “variables”, I had to “play” around putting more or less tab stops so that it detects them correctly.

Thank you very much for everything :wink: