observability-loki

Use the query_logs.py script with a LogQL string, for example a stream selector with line filters like {app="api"} |= "error". Add --type metric for aggregation queries such as rate(), and --json for machine-readable output.

Run get_statistics.py with a stream selector like {app="api"} and an optional --lookback window in hours. It reports total logs, error and warning counts, logs per minute, and the error rate percentage, flagging rates above 5 percent.

Loki supports exact match, regex match with =~, negation with !=, and line filters such as |= for contains and |~ for regex. You can also parse JSON or logfmt lines and filter on extracted labels, then aggregate with functions like rate and count_over_time.

Yes, the client supports bearer tokens via LOKI_TOKEN, basic auth via LOKI_USER and LOKI_PASSWORD, and multi-tenant org IDs via the LOKI_ORG_ID header. It can also run through a credential proxy using LOKI_BASE_URL with tenant context headers.

Empty results usually mean the stream selector matches no label combinations, the time window is wrong, or the line filter is too restrictive. First list available labels and values with list_labels.py, then widen the lookback window or relax the filter.