Using explore to search arrays

Grafana Loki
1

One of our services produces logs of the form:

{
  "level": \d+
  ...
  "data": {
    "items": [ {...item}, {...item} ...],
    ...
  }
  "msg": "searchable log message"
}

using explore I can search for items at specific array locations via: | json id="data.items[0].id" | id = \target id`` but I’d really like to be able to search at ANY position in the array. Is this possible?

I have tried items[\d+].id and a few other regex paths but always get parsing errors.

EDIT: added quotes to the json example to avoid confusion. It is valid json data

2

If the keys aren’t quote then it’s not valid json. I don’t think there is an easy solution for this, you would have to make it valid json before injecting into Loki.

3

it is valid json. i just quickly typed out an example data structure for the post

4

Apologies, misread your post.

The json filter doesn’t allow you to manipulate the result much. You might consider looking into template and see to what extent you are able to make it work (it’s supposed to be Go string template library). But I haven’t personally tried this and your option may be rather limited.