Wildcard in api to loki

Grafana Loki
1

Hi All,

I’ve tried this in grafana with Loki backend.
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:85:0+”
This works and generates me all the logs with mac address with the wildcard.

Now I’m trying this from API
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:85:0+”
Its returning zero rows.

If I use the full mac address it returns me all the correct rows.
However from API this works.
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:85:0*”

In both cases this will fail
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:*:0D”

Seems like wildcards seems to only work at the back of the search not in the middle.

Any idea what is wrong… or is the api syntax different?

Regards,

Michael

2

  1. Your regex expression is invalid. For your + and * they should be .+ and .* instead. I am not sure how your first example worked.

  2. Grafana query inspector will show you the API call, you can use that to compare to yours.

  3. LogQL Analyzer | Grafana Loki documentation is a helpful tool.

3

Thanks Tony.

I didn’t realise for + you needed a . to match some character first!

.* and * both work it seems.

4

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.