My application logs are in JSON, and are being consumed by Loki. I’d like to create a visualization of HTTP response codes over time that looks like this:
As you can see, the X axis is time, and each (stacked) bar contains the total count of a given response code over a particular period of time (looks like 10 minutes).
Here’s my LogQL query:
sum by (status) (
count_over_time(
{cluster="$cluster_name", namespace="$namespace_name", app="$app_pod_app_name"}
| json
| status!=""
[$__interval]
)
)
I’m using a Time Series visualization with the “Bars” style. This gives me something that looks like this (over the last 6 hours):
So it’s… close. I’m really struggling to figure out how to widen the bars, though. I know the count_over_time like I have here is a sliding window, so just changing $__interval to, say, 10m doesn’t fix it in a meaningful way, it just spreads the data out:
Clearly not what I want. I tried changing the “step” of the query to 15m (previously it was unset, thus auto):
That looks closer, but if you compare it to my initial attempt it’s clearly dropping data. I’m not entirely sure what changing this value is doing, but it doesn’t appear to be what I want either.
I’m afraid I don’t have the google-foo to even search for what exactly I’m trying to accomplish here because I’m struggling to put words to it. Any advice would be greatly appreciated!