I recently moved my application logging from Cloudwatch to Grafna-loki. Team used to fetch data to run query in Cloudwatch log insights like below:
fields *@timestamp* , activity, terminalID, clientID, full_message
| filter full_message like “Configuration”
| filter clientID like “121212121121"
| sort *@timestamp* desc
| limit 2000
Now I have log stored in Loki and able to view in Grafna UI, but how can I run the similar query in Grafana (logQL).
Sample log line json:
{"host":"ip-00-3001-1a08-test.us-west-1.compute.internal",
"short_message":"Sent message: {\"test\":{\"test\":\"31901300\",\"}}",
"full_message":"Sent message: {\"test\":{\"test\":\"31901300\"}}",
"timestamp":1.707740449767E9,
"level":6,
"facility":"logstash-abctest",
"simpleLogger":"test-abc",
"logSequence":9696969696,
"activity":"00000000222255544",
"logLevel":"INFO",
"logger":"test",
"senderType":"test",
"terminalID":"test300"}
And my logConfiguration is:
"logConfiguration": {
"logDriver": "awsfirelens",
"options": {
"LabelKeys": "container_name,ecs_task_definition,source,ecs_cluster",
"Labels": "{job=\"firelens\"}",
"LineFormat": "json",
"Name": "grafana-loki",
"RemoveKeys": "container_id,ecs_task_arn",
"Url": "http://loki.endpoint:3100/loki/api/v1/push"
}
Thank you in advance.
To solve the issue: I tried to add 'fields' in 'LabelKeys' like this:
"LabelKeys": "activity,full_message,senderType,container_name,ecs_task_definition,source,ecs_cluster",
But did not work.