Loki的查询语法

1.获取当前Loki的元数据类型

[root@master ~]# kubectl get svc -n monitoring
NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)           AGE
loki            ClusterIP   10.233.2.239   <none>        80/TCP,9095/TCP   13h
loki-pods       ClusterIP   None           <none>        <none>            13h
loki-promtail   ClusterIP   10.233.25.43   <none>        80/TCP,9095/TCP   13h

[root@master ~]# curl http://10.233.2.239/api/prom/label
{"values":["__name__","alertmanager","app","app_kubernetes_io_component","app_kubernetes_io_instance","app_kubernetes_io_name","app_kubernetes_io_part_of","app_kubernetes_io_version","component","container","control_plane","filename","hostname","job","k8s_app","namespace","notification_manager","pod","project","prometheus","release","role","stream","tier","version"]}

2.获取某个元数据类型的值

[root@master ~]# curl http://10.233.2.239/api/prom/label/namespace/values
{"values":["default","kube-system","kubesphere-logging-system","kubesphere-monitoring-system","kubesphere-system","monitoring","ops"]}

3.logQL语法基本使用

选择器：对于查询表达式的标签部分，将放在{}中，多个标签表达式用逗号分隔

支持的操作符：

• = 完全相同
• != 不等于
• =~ 正则表达式匹配
• !~ 不要正则表达式匹配

过滤表达式：

写好日志流选择器后，您可以通过编写搜索表达式进一步过滤结果。搜索表达式可以文本或正则表达式。

支持的操作符：

• |= line包含字符串。
• != line不包含字符串。
• |~ line匹配正则表达式。
• !~ line与正则表达式不匹配。

 例：

找出log中包含6.86.15.20的日志

{job="6.86.50.124-audit-log"} |="6.86.15.20" #精确匹配

找出log中不包含6.86.15.20的日志

{job="6.86.50.124-audit-log"} !="6.86.15.20"

正则匹配：

{job="6.86.50.124-audit-log"} |~"6.86"  #匹配包含6.86的日志属于模糊匹配

正则不匹配(排除)

{job="6.86.50.124-audit-log"} !~"6.86"