LogQL language preview

stream selector and pipeline line filters

horizon-dark

{job="app", env=~"prod|staging"}
  |= "error"
  != "timeout"

atom-one-dark

{job="app", env=~"prod|staging"}
  |= "error"
  != "timeout"

github-dark

{job="app", env=~"prod|staging"}
  |= "error"
  != "timeout"

dracula

{job="app", env=~"prod|staging"}
  |= "error"
  != "timeout"

nord

{job="app", env=~"prod|staging"}
  |= "error"
  != "timeout"

github

{job="app", env=~"prod|staging"}
  |= "error"
  != "timeout"

range aggregation over a filtered log stream

horizon-dark

sum by (job) (
  rate({job="app"} |= "error" [5m])
)

atom-one-dark

sum by (job) (
  rate({job="app"} |= "error" [5m])
)

github-dark

sum by (job) (
  rate({job="app"} |= "error" [5m])
)

dracula

sum by (job) (
  rate({job="app"} |= "error" [5m])
)

nord

sum by (job) (
  rate({job="app"} |= "error" [5m])
)

github

sum by (job) (
  rate({job="app"} |= "error" [5m])
)

a [1h30m]-style range combining two number+unit segments

horizon-dark

max_over_time(
  {job="app"} | json | unwrap duration [1h30m]
) by (route)

atom-one-dark

max_over_time(
  {job="app"} | json | unwrap duration [1h30m]
) by (route)

github-dark

max_over_time(
  {job="app"} | json | unwrap duration [1h30m]
) by (route)

dracula

max_over_time(
  {job="app"} | json | unwrap duration [1h30m]
) by (route)

nord

max_over_time(
  {job="app"} | json | unwrap duration [1h30m]
) by (route)

github

max_over_time(
  {job="app"} | json | unwrap duration [1h30m]
) by (route)

parser stage, unwrap, and quantile aggregation

horizon-dark

quantile_over_time(0.99,
  {job="app"} | json | unwrap duration [5m]
) by (route)

atom-one-dark

quantile_over_time(0.99,
  {job="app"} | json | unwrap duration [5m]
) by (route)

github-dark

quantile_over_time(0.99,
  {job="app"} | json | unwrap duration [5m]
) by (route)

dracula

quantile_over_time(0.99,
  {job="app"} | json | unwrap duration [5m]
) by (route)

nord

quantile_over_time(0.99,
  {job="app"} | json | unwrap duration [5m]
) by (route)

github

quantile_over_time(0.99,
  {job="app"} | json | unwrap duration [5m]
) by (route)