This article explains how to modify Promtail configuration to extract log properties and store them as labels for better indexing and querying in Loki.
In this article, we explore how to modify your Promtail configuration to extract specific log properties—such as the HTTP method and status code—and store them as labels. This enhancement enables more efficient indexing and querying within Loki. The guide below walks you through understanding the log structure, updating your Promtail configuration, deploying the changes, and verifying the results in Grafana.
Promtail handles logs that include embedded JSON strings. Consider sample log entries where properties like the HTTP method, route, and status code are embedded within a JSON object. Although you can still search for text, promoting these values to labels simplifies filtering and querying. For example, a typical log entry might appear as follows:
Within these log entries, the JSON object includes a “log” property that holds another JSON string. The objective is to extract the values of “code” and “method” from this nested JSON and use them as labels in Loki.
To extract these properties as labels, update your Promtail configuration file (typically named promtail.yaml). Begin by examining the log structure to confirm the placement of the required data, and then add a new pipeline stage.Below is an example of the original Promtail configuration snippet:
Now, integrate a new pipeline stage that uses the “match” stage to target pods by their labels, followed by JSON stages to extract the desired properties. The updated snippet appears as follows:
The first JSON stage extracts the inner “log” property from the incoming message, while the second JSON stage works on the extracted “log” object to obtain the “code” and “method” fields. These extracted properties can then be used as labels in Loki for more detailed queries.
After deploying the updated configuration, return to Grafana to confirm that the labels have been correctly applied. Look for log entries that now include the code and method labels. For example:
Using Grafana’s query builder, you can now perform filtered searches. For instance, to find log entries with a status code of “200”, use a query like:
Copy
Ask AI
{pod="api-5bb95b4844-ln5xk", code="200"} |= ""
This confirms that Promtail successfully extracts and assigns the desired log properties as labels, enabling more precise search capabilities in Loki.By following these detailed steps, you have enhanced your logging pipeline by converting essential log properties into labels. This improved configuration not only streamlines the log analysis process but also boosts the efficiency of your monitoring setup using Grafana and Loki.For additional guidance, check out the official Loki Documentation and Promtail Repository.
