logcli

What it does

How to write it

logcli [--addr=URL] query 'LOGQL' [--since=1h] [--limit=N] [--tail]
logcli labels [NAME]

Main parts

Commands

query 'LOGQL'

Search logs.

instant-query 'LOGQL'

Metric query at one time.

labels [NAME]

List labels / values of one label.

series 'SELECTOR'

List streams.

stats 'SELECTOR'

Size of the data.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Set the address

   $export LOKI_ADDR=http://loki.monitoring.svc:3100
   $logcli labels
   $logcli labels namespace

2. 2Find errors of one app

   $logcli query '{namespace="shop", app="api"} |= "error"' --since=1h --limit=50

3. 3Follow logs live

   $logcli query '{namespace="shop"}' --tail

4. 4Parse JSON logs and filter by a field

   $logcli query '{app="api"} | json | status >= 500 | line_format "{{.method}} {{.path}} {{.status}}"' --since=30m

5. 5Count errors per app (metric query)

   $logcli instant-query 'sum by (app) (count_over_time({namespace="shop"} |= "error" [5m]))'

6. 6Find failed SSH logins on all hosts

   $logcli query '{job="systemd-journal", unit="sshd.service"} |~ "Failed password|Invalid user"' --since=24h

7. 7Exclude noise

   $logcli query '{app="ingress-nginx"} != "/health" != "/metrics"' --since=15m

8. 8Save raw lines to a file

   $logcli query '{app="api"}' --since=2h --limit=5000 -o raw > api.log

9. 9Install Loki with Helm (single binary, lab)

   $helm repo add grafana https://grafana.github.io/helm-charts
   $helm install loki grafana/loki -n monitoring -f loki-values.yaml

10. 10Alert on log lines (Loki ruler)

    $cat rules/shop.yml
    groups:
      - name: shop-logs
        rules:
          - alert: ManyErrors
            expr: sum(rate({namespace="shop"} |= "error" [5m])) > 1

Nothing matches this filter.

Files

/etc/loki/config.yaml

Loki server config (path can differ).

Exit codes