loki-troubleshoot

Efficient LogQL queries use low-cardinality labels for filtering, narrow time windows (minutes to hours), and fast filters like |= and |!= before any JSON parsing. This approach minimizes expensive log scans and retrieves results quickly across your services.

Target your error logs by combining label filters with your service name, apply a tight time window around when the error occurred, use fast text filters to locate error messages, then parse structured fields only after filtering narrows the dataset.

Regex and immediate JSON parsing force Loki to scan all matching logs before filtering, creating expensive operations. Applying fast filters (|=, |!=) first dramatically reduces the dataset Loki must parse, improving query performance and resource usage.

Yes. Use label-based filtering to target your service, apply a fast filter with |= to match the request ID string, and set a narrow time window. This efficiently locates all logs for that request without scanning unrelated entries.

Use low-cardinality labels like service name, environment, and log level as your primary filters. Avoid labels with unbounded values (user IDs, request IDs, timestamps). Structure queries to filter by these stable labels first, then search within the reduced result set.

Combine service and environment labels in your query using label matchers, set a specific time range, then apply fast text filters for your search term. This approach keeps scans focused and prevents accidentally querying unrelated services or stale data.