Wildcard in api to loki

Hi All,

I’ve tried this in grafana with Loki backend.
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:85:0+”
This works and generates me all the logs with mac address with the wildcard.

Now I’m trying this from API
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:85:0+”
Its returning zero rows.

If I use the full mac address it returns me all the correct rows.
However from API this works.
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:85:0*”

In both cases this will fail
{application=“lawful_intercept”} | logfmt |~ “MAC=68:54:5A:27:*:0D”

Seems like wildcards seems to only work at the back of the search not in the middle.

Any idea what is wrong… or is the api syntax different?



  1. Your regex expression is invalid. For your + and * they should be .+ and .* instead. I am not sure how your first example worked.

  2. Grafana query inspector will show you the API call, you can use that to compare to yours.

  3. LogQL Analyzer | Grafana Loki documentation is a helpful tool.

Thanks Tony.

I didn’t realise for + you needed a . to match some character first!

.* and * both work it seems.