I am using Alloy to send Kubernetes log to Loki and Explore/Drilldown to visualize the log. Here is the Alloy config snippet that I use to specify the labels and structured metadata:
which is as I expected: the labels and structured metadata fields are what I specified with several auto-added label from Alloy’s discovery component.
But when seen in Drilldown, there are additional “parsed labels”:
Sorry, I forget to include the version info. I am using Grafana v12.0.0, simple scalable deployment Loki v3.5.0 from Helm chart v6.3.0, and Alloy v1.9.0 as Deployment from Helm chart v1.1.0
@hz00 Logs Drilldown automatically adds parsers (logfmt, json) to your queries so the application can visualize/filter on fields parsed in unstructured log lines. If you add | logfmt to the end of your query in Explore, you’ll see the same parsed fields that are showing in Logs Drilldown.
@hz00 parsers are always added to the logs panel queries in Logs Drilldown, but will only be added to time series queries (i.e. in the labels/fields breakdown tabs) if the user has added a (non metadata) filter, or the field being displayed is not a metadata field.
It is not something that can be turned off as that would make it impossible for users to filter on fields. If you need this level of control over your queries I would suggest sticking to dashboards and classic explore, and not Logs Drilldown.