Grafana Loki Logging - Search in the json Fields

28 Views Asked by At

I recently moved my application logging from Cloudwatch to Grafna-loki. Team used to fetch data to run query in Cloudwatch log insights like below:

fields *@timestamp* , activity, terminalID, clientID, full_message
| filter full_message like “Configuration”
| filter clientID like “121212121121"
| sort *@timestamp* desc
| limit 2000

Now I have log stored in Loki and able to view in Grafna UI, but how can I run the similar query in Grafana (logQL).

Sample log line json:

{"host":"ip-00-3001-1a08-test.us-west-1.compute.internal",
"short_message":"Sent message: {\"test\":{\"test\":\"31901300\",\"}}",
"full_message":"Sent message: {\"test\":{\"test\":\"31901300\"}}",
"timestamp":1.707740449767E9,
"level":6,
"facility":"logstash-abctest",
"simpleLogger":"test-abc",
"logSequence":9696969696,
"activity":"00000000222255544",
"logLevel":"INFO",
"logger":"test",
"senderType":"test",
"terminalID":"test300"}

And my logConfiguration is:

"logConfiguration": {
                "logDriver": "awsfirelens",
                "options": {
                    "LabelKeys": "container_name,ecs_task_definition,source,ecs_cluster",
                    "Labels": "{job=\"firelens\"}",
                    "LineFormat": "json",
                    "Name": "grafana-loki",
                    "RemoveKeys": "container_id,ecs_task_arn",
                    "Url": "http://loki.endpoint:3100/loki/api/v1/push"
                }

Thank you in advance.

To solve the issue: I tried to add 'fields' in 'LabelKeys' like this:

"LabelKeys": "activity,full_message,senderType,container_name,ecs_task_definition,source,ecs_cluster",

But did not work.

0

There are 0 best solutions below