LogCLI 시작하기
logcli는 Loki 인스턴스를 대상으로 LogQL 쿼리를 실행할 수 있는 커맨드라인 클라이언트예요. 이 문서에서는 logcli 설치부터 인증 방법, 명령어 레퍼런스, 예시 쿼리와 문제 해결까지 차근차근 살펴봐요.
본문
logcli는 Loki 인스턴스를 대상으로 LogQL 쿼리를 실행할 수 있는 커맨드라인 클라이언트예요. query 명령은 쿼리와 그 결과에 대한 부가 정보도 함께 출력해 주는데요, API URL, 공통 레이블 집합, 제외된 레이블 집합 같은 것들이 여기에 해당해요.
예를 들어 Loki에서 특정 기간의 로그를 내려받고 싶을 때 유용해요. 분석·관리 작업을 할 때도 쓸 수 있죠. 로그 스트림 개수를 세어 레이블 카디널리티를 파악하거나, 쿼리가 검색하게 될 데이터 볼륨을 미리 추정해 볼 수도 있어요. 셸 스크립트의 일부로 logcli를 활용하는 것도 가능하고요.
Grafana Cloud 사용자라면 Cloud Logs Export로 장기 스토리지에 내보낸 로그를 logcli로 조회할 수도 있어요. 그 밖의 Loki 형식 로그 데이터 역시 마찬가지예요.
{{< admonition type="note" >}} logcli는 조회 전용 도구라는 점을 기억해 주세요. 로그를 수집(ingest)하는 데는 사용할 수 없어요. {{< /admonition >}}
logcli 설치하기
모범 사례로는, 사용 중인 Loki 버전과 맞는 logcli 버전을 내려받는 게 좋아요. Loki 버전을 업그레이드할 때는 logcli도 함께 업그레이드하고요.
바이너리 (권장)
Loki 릴리스 페이지에서 logcli 바이너리를 내려받으세요.
Linux, Mac, Windows용 빌드가 모두 준비되어 있어요.
소스에서 LogCLI 빌드하기
Loki 저장소를 클론한 뒤 logcli를 소스에서 빌드해 봐요:
git clone https://github.com/grafana/loki.git
cd loki
make logcli
원하면 빌드된 바이너리를 $PATH에 포함된 디렉터리로 옮겨 둬요.
cp cmd/logcli/logcli /usr/local/bin/logcli
명령어 자동 완성 설정하기
사용하는 셸에 따라 다음 두 가지 방법 중 하나로 logcli 탭 자동 완성을 설정할 수 있어요:
- bash라면
~/.bashrc파일에 이 내용을 추가해 주세요:
export LOKI_ADDR=http://localhost:3100
logcli query '{service_name="website"}'
- zsh라면
~/.zshrc파일에 이 내용을 추가해 주세요:
export LOKI_ADDR=https://logs-us-west1.grafana.net
export LOKI_USERNAME=<username>
export LOKI_PASSWORD=<password>
logcli query '{service_name="website"}'
LogCLI 사용법
logcli를 설치했다면 다음과 같이 실행할 수 있어요:
logcli <command> [<flags>, <args> ...]
<command>는 아래 명령어 레퍼런스에서 자세히 다루는 명령 중 하나를 가리켜요.
<flags>는 각 명령에서 사용할 수 있는 서브커맨드(플래그) 가운데 하나예요.
<args>는 공백으로 구분된 인수 목록이에요. 인수는 환경 변수로 대신 지정할 수도 있고요. 이때는 환경 변수가 항상 커맨드라인 인수보다 우선해요.
Loki에 인증하기
Loki 인스턴스에 연결하려면 다음 인수를 설정하세요:
--addr=http://loki.example.com:3100또는LOKI_ADDR환경 변수
예를 들어 사용자 이름과 비밀번호 없이 로컬 Loki 인스턴스를 바로 조회하려면 이렇게 해요:
usage: logcli [<flags>] <command> [<args> ...]
A command-line for loki.
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--log.level Only log messages with the given severity or above. Valid levels: [debug, info, warn, error]
Commands:
help [<command>...]
Show help.
query [<flags>] <query>
Run a LogQL query.
The "query" command is useful for querying for logs. Logs can be returned in
a few output modes:
raw: log line
default: log timestamp + log labels + log line
jsonl: JSON response from Loki API of log line
The output of the log can be specified with the "-o" flag, for example,
"-o raw" for the raw output format.
The "query" command will output extra information about the query and its
results, such as the API URL, set of common labels, and set of excluded
labels. This extra information can be suppressed with the --quiet flag.
By default we look over the last hour of data; use --since to modify or
provide specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag. In default output mode the
--output-timestamp-format flag can be used to modify the output timestamp.
Example:
logcli query
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output=jsonl
'my-query'
Example with --output-timestamp-format:
logcli query
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output-timestamp-format=rfc3339nano
'my-query'
The output is limited to 30 entries by default; use --limit to increase.
While "query" does support metrics queries, its output contains multiple
data points between the start and end query time. This output is used to
build graphs, similar to what is seen in the Grafana Explore graph view.
If you are querying metrics and just want the most recent data point (like
what is seen in the Grafana Explore table view), then you should use the
"instant-query" command instead.
Parallelization:
You can download an unlimited number of logs in parallel, there are a few
flags which control this behaviour:
--parallel-duration
--parallel-max-workers
--part-path-prefix
--overwrite-completed-parts
--merge-parts
--keep-parts
Refer to the help for each flag for details about what each of them do.
Example:
logcli query
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output=jsonl
--parallel-duration="15m"
--parallel-max-workers="4"
--part-path-prefix="/tmp/my_query"
--merge-parts
'my-query'
This example will create a queue of jobs to execute, each being 15 minutes
in duration. In this case, that means, for the 10-hour total duration,
there will be forty 15-minute jobs. The --limit flag is ignored.
It will start four workers, and they will each take a job to work on from
the queue until all the jobs have been completed.
Each job will save a "part" file to the location specified by the
--part-path-prefix. Different prefixes can be used to run multiple queries
at the same time. The timestamp of the start and end of the part is in
the file name. While the part is being downloaded, the filename will
end in ".part", when it is complete, the file will be renamed to remove
this ".part" extension. By default, if a completed part file is found,
that part will not be downloaded again. This can be overridden with the
--overwrite-completed-parts flag.
Part file example using the previous command, adding --keep-parts so they
are not deleted:
Since we don't have the --forward flag, the parts will be downloaded in
reverse. Two of the workers have finished their jobs (last two files),
and have picked up the next jobs in the queue. Running ls, this is what we
should expect to see.
$ ls -1 /tmp/my_query*
/tmp/my_query_20210119T183000_20210119T184500.part.tmp
/tmp/my_query_20210119T184500_20210119T190000.part.tmp
/tmp/my_query_20210119T190000_20210119T191500.part.tmp
/tmp/my_query_20210119T191500_20210119T193000.part.tmp
/tmp/my_query_20210119T193000_20210119T194500.part
/tmp/my_query_20210119T194500_20210119T200000.part
If you do not specify the --merge-parts flag, the part files will be
downloaded, and logcli will exit, and you can process the files as you wish.
With the flag specified, the part files will be read in order, and the
output printed to the terminal. The lines will be printed as soon as the
next part is complete, you don't have to wait for all the parts to download
before getting output. The --merge-parts flag will remove the part files
when it is done reading each of them. To change this, you can use the
--keep-parts flag, and the part files will not be removed.
instant-query [<flags>] <query>
Run an instant LogQL query.
The "instant-query" command is useful for evaluating a metric query for a
single point in time. This is equivalent to the Grafana Explore table view;
if you want a metrics query that is used to build a Grafana graph, you
should use the "query" command instead.
This command does not produce useful output when querying for log lines;
you should always use the "query" command when you are running log queries.
For more information about log queries and metric queries, refer to the
LogQL documentation:
https://grafana.com/docs/loki/latest/logql/
labels [<flags>] [<label>]
Find values for a given label.
series [<flags>] <matcher>
Run series query.
The "series" command will take the provided label matcher and return all the
log streams found in the time window.
It is possible to send an empty label matcher '{}' to return all streams.
Use the --analyze-labels flag to get a summary of the labels found in all
streams. This is helpful to find high cardinality labels.
fmt
Formats a LogQL query.
stats [<flags>] <query>
Run a stats query.
The "stats" command will take the provided query and return statistics
from the index on how much data is contained in the matching stream(s).
This only works against Loki instances using the TSDB index format.
By default we look over the last hour of data; use --since to modify or
provide specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli stats
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
'my-query'
volume [<flags>] <query>
Run a volume query.
The "volume" command will take the provided label selector(s) and return
aggregate volumes for series matching those volumes. This only works against
Loki instances using the TSDB index format.
By default we look over the last hour of data; use --since to modify or
provide specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli volume
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
'my-query'
volume_range [<flags>] <query>
Run a volume query and return timeseries data.
The "volume_range" command will take the provided label selector(s) and
return aggregate volumes for series matching those volumes, aggregated into
buckets according to the step value. This only works against Loki instances
using the TSDB index format.
By default we look over the last hour of data; use --since to modify or
provide specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli volume_range
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--step=1h
'my-query'
detected-fields [<flags>] <query> [<field>]
Run a query for detected fields..
delete <command> [<args> ...]
Manage log deletion requests.
The "detected-fields" command will return information about fields detected
using either the "logfmt" or "json" parser against the log lines returned by
the provided query for the provided time range.
The "detected-fields" command will output extra information about the query
and its results, such as the API URL, set of common labels, and set of
excluded labels. This extra information can be suppressed with the --quiet
flag.
By default we look over the last hour of data; use --since to modify or
provide specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli detected-fields
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output=jsonl
'my-query'
The output is limited to 100 fields by default; use --field-limit to
increase. The query is limited to processing 1000 lines per subquery;
use --line-limit to increase.
인증이 필요한 Loki 인스턴스에 연결하려면 다음 인수도 함께 설정해야 해요:
--username또는LOKI_USERNAME환경 변수--password또는LOKI_PASSWORD환경 변수
Grafana Cloud를 조회하는 예시예요:
usage: logcli query [<flags>] <query>
Run a LogQL query.
The "query" command is useful for querying for logs. Logs can be returned in a
few output modes:
raw: log line
default: log timestamp + log labels + log line
jsonl: JSON response from Loki API of log line
The output of the log can be specified with the "-o" flag, for example, "-o raw"
for the raw output format.
The "query" command will output extra information about the query and its
results, such as the API URL, set of common labels, and set of excluded labels.
This extra information can be suppressed with the --quiet flag.
By default we look over the last hour of data; use --since to modify or provide
specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag. In default output mode the
--output-timestamp-format flag can be used to modify the output timestamp.
Example:
logcli query
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output=jsonl
'my-query'
Example with --output-timestamp-format:
logcli query
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output-timestamp-format=rfc3339nano
'my-query'
The output is limited to 30 entries by default; use --limit to increase.
While "query" does support metrics queries, its output contains multiple data
points between the start and end query time. This output is used to build
graphs, similar to what is seen in the Grafana Explore graph view. If you are
querying metrics and just want the most recent data point (like what is seen in
the Grafana Explore table view), then you should use the "instant-query" command
instead.
Parallelization:
You can download an unlimited number of logs in parallel, there are a few flags
which control this behaviour:
--parallel-duration
--parallel-max-workers
--part-path-prefix
--overwrite-completed-parts
--merge-parts
--keep-parts
Refer to the help for each flag for details about what each of them do.
Example:
logcli query
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output=jsonl
--parallel-duration="15m"
--parallel-max-workers="4"
--part-path-prefix="/tmp/my_query"
--merge-parts
'my-query'
This example will create a queue of jobs to execute, each being 15 minutes in
duration. In this case, that means, for the 10-hour total duration, there will
be forty 15-minute jobs. The --limit flag is ignored.
It will start four workers, and they will each take a job to work on from the
queue until all the jobs have been completed.
Each job will save a "part" file to the location specified by the
--part-path-prefix. Different prefixes can be used to run multiple queries at
the same time. The timestamp of the start and end of the part is in the file
name. While the part is being downloaded, the filename will end in ".part",
when it is complete, the file will be renamed to remove this ".part" extension.
By default, if a completed part file is found, that part will not be downloaded
again. This can be overridden with the --overwrite-completed-parts flag.
Part file example using the previous command, adding --keep-parts so they are
not deleted:
Since we don't have the --forward flag, the parts will be downloaded in reverse.
Two of the workers have finished their jobs (last two files), and have picked up
the next jobs in the queue. Running ls, this is what we should expect to see.
$ ls -1 /tmp/my_query* /tmp/my_query_20210119T183000_20210119T184500.part.tmp
/tmp/my_query_20210119T184500_20210119T190000.part.tmp
/tmp/my_query_20210119T190000_20210119T191500.part.tmp
/tmp/my_query_20210119T191500_20210119T193000.part.tmp
/tmp/my_query_20210119T193000_20210119T194500.part
/tmp/my_query_20210119T194500_20210119T200000.part
If you do not specify the --merge-parts flag, the part files will be downloaded,
and logcli will exit, and you can process the files as you wish. With the flag
specified, the part files will be read in order, and the output printed to
the terminal. The lines will be printed as soon as the next part is complete,
you don't have to wait for all the parts to download before getting output.
The --merge-parts flag will remove the part files when it is done reading each
of them. To change this, you can use the --keep-parts flag, and the part files
will not be removed.
Flags:
--[no-]help Show context-sensitive help (also try
--help-long and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting
output timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory
profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE
env var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API
requests for authentication purposes.
Can also be set using LOKI_BEARER_TOKEN env var.
($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg
HTTP_PROXY ($LOKI_ENV_PROXY)
--limit=30 Limit on number of entries to print. Setting it
to 0 will fetch all entries.
--since=1h Lookback window.
--from=FROM Start looking for logs at this absolute time
(inclusive)
--to=TO Stop looking for logs at this absolute time
(exclusive)
--step=STEP Query resolution step width, for metric queries.
Evaluate the query at the specified step over
the time range.
--interval=INTERVAL Query interval, for log queries. Return entries
at the specified interval, ignoring those
between. **This parameter is experimental,
please see Issue 1779**
--batch=1000 Query batch size to use until 'limit' is reached
--parallel-duration=1h Split the range into jobs of this length to
download the logs in parallel. This will
result in the logs being out of order.
Use --part-path-prefix to create a file per job
to maintain ordering.
--parallel-max-workers=1 Max number of workers to start up for parallel
jobs. A value of 1 will not create any parallel
workers. When using parallel workers, limit is
ignored.
--part-path-prefix=PART-PATH-PREFIX
When set, each server response will be saved
to a file with this prefix. Creates files in
the format: 'prefix-utc_start-utc_end.part'.
Intended to be used with the parallel-* flags
so that you can combine the files to maintain
ordering based on the filename. Default is to
write to stdout.
--[no-]overwrite-completed-parts
Overwrites completed part files. This will
download the range again, and replace the
original completed part file. Default will skip
a range if it's part file is already downloaded.
--[no-]merge-parts Reads the part files in order and writes the
output to stdout. Original part files will be
deleted with this option.
--[no-]keep-parts Overrides the default behaviour of --merge-parts
which will delete the part files once all the
files have been read. This option will keep the
part files.
--[no-]forward Scan forwards through logs.
--[no-]no-labels Do not print any labels
--exclude-label=EXCLUDE-LABEL ...
Exclude labels given the provided key during
output.
--include-label=INCLUDE-LABEL ...
Include labels given the provided key during
output.
--[no-]include-common-labels
Include common labels in output for each log
line.
--labels-length=0 Set a fixed padding to labels
--store-config="" Execute the current query using a configured
storage from a given Loki configuration file.
--[no-]remote-schema Execute the current query using a remote schema
retrieved from the configured -schema-store.
--schema-store="" Store used for retrieving remote schema.
--[no-]colored-output Show output with colored labels
-t, --[no-]tail Tail the logs
-f, --[no-]follow Alias for --tail
--delay-for=0 Delay in tailing by number of seconds to
accumulate logs for re-ordering
Args:
<query> eg '{foo="bar",baz=~".*blip"} |~ ".*error.*"'
특정 테넌트를 지정하려면 다음 인수를 설정하세요:
--org-id또는LOKI_ORG_ID환경 변수
{{< admonition type="note" >}} 프록시 서버 뒤에서 Loki를 운영 중이고 인증이 설정되어 있다면, LOKI_USERNAME과 LOKI_PASSWORD, 그리고 상황에 맞춰 LOKI_BEARER_TOKEN 또는 LOKI_BEARER_TOKEN_FILE도 함께 전달해야 해요. {{< /admonition >}}
LogCLI 명령어 레퍼런스
logcli help의 출력 결과예요:
usage: logcli instant-query [<flags>] <query>
Run an instant LogQL query.
The "instant-query" command is useful for evaluating a metric query for a
single point in time. This is equivalent to the Grafana Explore table view;
if you want a metrics query that is used to build a Grafana graph, you should
use the "query" command instead.
This command does not produce useful output when querying for log lines;
you should always use the "query" command when you are running log queries.
For more information about log queries and metric queries, refer to the LogQL
documentation:
https://grafana.com/docs/loki/latest/logql/
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--limit=30 Limit on number of entries to print. Setting it to
0 will fetch all entries.
--now=NOW Time at which to execute the instant query.
--[no-]forward Scan forwards through logs.
--[no-]no-labels Do not print any labels
--exclude-label=EXCLUDE-LABEL ...
Exclude labels given the provided key during
output.
--include-label=INCLUDE-LABEL ...
Include labels given the provided key during
output.
--[no-]include-common-labels
Include common labels in output for each log line.
--labels-length=0 Set a fixed padding to labels
--store-config="" Execute the current query using a configured
storage from a given Loki configuration file.
--[no-]remote-schema Execute the current query using a remote schema
retrieved from the configured -schema-store.
--schema-store="" Store used for retrieving remote schema.
--[no-]colored-output Show output with colored labels
Args:
<query> eg 'rate({foo="bar"} |~ ".*error.*" [5m])'
query 명령어 레퍼런스
logcli help query의 출력 결과예요:
usage: logcli labels [<flags>] [<label>]
Find values for a given label.
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--since=1h Lookback window.
--from=FROM Start looking for labels at this absolute time
(inclusive)
--to=TO Stop looking for labels at this absolute time
(exclusive)
Args:
[<label>] The name of the label.
instant-query 명령어 레퍼런스
logcli help instant-query의 출력 결과예요:
usage: logcli series [<flags>] <matcher>
Run series query.
The "series" command will take the provided label matcher and return all the log
streams found in the time window.
It is possible to send an empty label matcher '{}' to return all streams.
Use the --analyze-labels flag to get a summary of the labels found in all
streams. This is helpful to find high cardinality labels.
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--since=1h Lookback window.
--from=FROM Start looking for logs at this absolute time
(inclusive)
--to=TO Stop looking for logs at this absolute time
(exclusive)
--[no-]analyze-labels Printout a summary of labels including count of
label value combinations, useful for debugging
high cardinality series
Args:
<matcher> eg '{foo="bar",baz=~".*blip"}'
labels 명령어 레퍼런스
logcli help labels의 출력 결과예요:
usage: logcli stats [<flags>] <query>
Run a stats query.
The "stats" command will take the provided query and return statistics from the
index on how much data is contained in the matching stream(s). This only works
against Loki instances using the TSDB index format.
By default we look over the last hour of data; use --since to modify or provide
specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli stats
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
'my-query'
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--since=1h Lookback window.
--from=FROM Start looking for logs at this absolute time
(inclusive)
--to=TO Stop looking for logs at this absolute time
(exclusive)
Args:
<query> eg '{foo="bar",baz=~".*blip"} |~ ".*error.*"'
series 명령어 레퍼런스
logcli help series의 출력 결과예요:
usage: logcli volume [<flags>] <query>
Run a volume query.
The "volume" command will take the provided label selector(s) and return
aggregate volumes for series matching those volumes. This only works against
Loki instances using the TSDB index format.
By default we look over the last hour of data; use --since to modify or provide
specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli volume
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
'my-query'
Flags:
--[no-]help Show context-sensitive help (also try
--help-long and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting
output timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory
profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE
env var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API
requests for authentication purposes.
Can also be set using LOKI_BEARER_TOKEN env var.
($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg
HTTP_PROXY ($LOKI_ENV_PROXY)
--since=1h Lookback window.
--from=FROM Start looking for logs at this absolute time
(inclusive)
--to=TO Stop looking for logs at this absolute time
(exclusive)
--limit=30 Limit on number of series to return volumes for.
--targetLabels=TARGETLABELS ...
List of labels to aggregate results into.
--[no-]aggregateByLabels Whether to aggregate results by label name only.
Args:
<query> eg '{foo="bar",baz=~".*blip"}
stats 명령어 레퍼런스
logcli help stats의 출력 결과예요:
usage: logcli volume_range [<flags>] <query>
Run a volume query and return timeseries data.
The "volume_range" command will take the provided label selector(s) and return
aggregate volumes for series matching those volumes, aggregated into buckets
according to the step value. This only works against Loki instances using the
TSDB index format.
By default we look over the last hour of data; use --since to modify or provide
specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli volume_range
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--step=1h
'my-query'
Flags:
--[no-]help Show context-sensitive help (also try
--help-long and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting
output timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory
profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE
env var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API
requests for authentication purposes.
Can also be set using LOKI_BEARER_TOKEN env var.
($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg
HTTP_PROXY ($LOKI_ENV_PROXY)
--since=1h Lookback window.
--from=FROM Start looking for logs at this absolute time
(inclusive)
--to=TO Stop looking for logs at this absolute time
(exclusive)
--limit=30 Limit on number of series to return volumes for.
--targetLabels=TARGETLABELS ...
List of labels to aggregate results into.
--[no-]aggregateByLabels Whether to aggregate results by label name only.
--step=1h Query resolution step width, roll up volumes
into buckets cover step time each.
Args:
<query> eg '{foo="bar",baz=~".*blip"}
volume 명령어 레퍼런스
logcli help volume의 출력 결과예요:
usage: logcli detected-fields [<flags>] <query> [<field>]
Run a query for detected fields..
The "detected-fields" command will return information about fields detected
using either the "logfmt" or "json" parser against the log lines returned by the
provided query for the provided time range.
The "detected-fields" command will output extra information about the query
and its results, such as the API URL, set of common labels, and set of excluded
labels. This extra information can be suppressed with the --quiet flag.
By default we look over the last hour of data; use --since to modify or provide
specific start and end times with --from and --to respectively.
Notice that when using --from and --to then ensure to use RFC3339Nano time
format, but without timezone at the end. The local timezone will be added
automatically or if using --timezone flag.
Example:
logcli detected-fields
--timezone=UTC
--from="2021-01-19T10:00:00Z"
--to="2021-01-19T20:00:00Z"
--output=jsonl
'my-query'
The output is limited to 100 fields by default; use --field-limit to increase.
The query is limited to processing 1000 lines per subquery; use --line-limit to
increase.
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--limit=100 Limit on number of fields or values to return.
--line-limit=1000 Limit the number of lines each subquery is allowed
to process.
--since=1h Lookback window.
--from=FROM Start looking for logs at this absolute time
(inclusive)
--to=TO Stop looking for logs at this absolute time
(exclusive)
--step=10s Query resolution step width, for metric queries.
Evaluate the query at the specified step over the
time range.
Args:
<query> eg '{foo="bar",baz=~".*blip"} |~ ".*error.*"'
[<field>] The name of the field.
volume_range 명령어 레퍼런스
logcli help volume_range의 출력 결과예요:
usage: logcli delete <command> [<args> ...]
Manage log deletion requests.
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
Subcommands:
delete create [<flags>] <query>
Create a new log deletion request.
The "delete create" command creates a new log deletion request for the
specified query and time range.
Example:
logcli delete create '{job="app"}' --from="2023-01-01T00:00:00Z" --to="2023-01-02T00:00:00Z"
delete list
List existing log deletion requests.
The "delete list" command lists all existing log deletion requests for the
tenant.
Example:
logcli delete list
logcli delete list --output=json
delete cancel --request-id=REQUEST-ID [<flags>]
Cancel a log deletion request.
The "delete cancel" command cancels an existing log deletion request by ID.
Example:
logcli delete cancel --request-id="abc123"
logcli delete cancel --request-id="abc123" --force
detected-fields 명령어 레퍼런스
logcli help detected-fields의 출력 결과예요:
usage: logcli delete create [<flags>] <query>
Create a new log deletion request.
The "delete create" command creates a new log deletion request for the specified
query and time range.
Example:
logcli delete create '{job="app"}' --from="2023-01-01T00:00:00Z" --to="2023-01-02T00:00:00Z"
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--since=1h Lookback window.
--from=FROM Start time for deletion (inclusive)
--to=TO End time for deletion (exclusive)
--max-interval=MAX-INTERVAL
Maximum time interval for delete request
Args:
<query> LogQL query to match log lines for deletion (e.g. '{job="app"}')
delete 명령어 레퍼런스
logcli help delete의 출력 결과예요:
usage: logcli delete list
List existing log deletion requests.
The "delete list" command lists all existing log deletion requests for the
tenant.
Example:
logcli delete list
logcli delete list --output=json
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting output
timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
delete create 명령어 레퍼런스
logcli help delete create의 출력 결과예요:
usage: logcli delete cancel --request-id=REQUEST-ID [<flags>]
Cancel a log deletion request.
The "delete cancel" command cancels an existing log deletion request by ID.
Example:
logcli delete cancel --request-id="abc123"
logcli delete cancel --request-id="abc123" --force
Flags:
--[no-]help Show context-sensitive help (also try --help-long
and --help-man).
--[no-]version Show application version.
-q, --[no-]quiet Suppress query metadata
--[no-]stats Show query statistics
-o, --output=default Specify output mode [default, raw, jsonl].
raw suppresses log labels and timestamp.
-z, --timezone=Local Specify the timezone to use when formatting
output timestamps [Local, UTC]
--output-timestamp-format=rfc3339
Specify the format of timestamps in the default
output mode [rfc3339, rfc3339nano, rfc822z,
rfc1123z, stampmicro, stampmilli, stampnano,
unixdate]
--cpuprofile="" Specify the location for writing a CPU profile.
--memprofile="" Specify the location for writing a memory
profile.
--[no-]stdin Take input logs from stdin
--addr="http://localhost:3100"
Server address. Can also be set using LOKI_ADDR
env var. ($LOKI_ADDR)
--username="" Username for HTTP basic auth. Can also be set
using LOKI_USERNAME env var. ($LOKI_USERNAME)
--password="" Password for HTTP basic auth. Can also be set
using LOKI_PASSWORD env var. ($LOKI_PASSWORD)
--ca-cert="" Path to the server Certificate Authority.
Can also be set using LOKI_CA_CERT_PATH env var.
($LOKI_CA_CERT_PATH)
--[no-]tls-skip-verify Server certificate TLS skip verify. Can also
be set using LOKI_TLS_SKIP_VERIFY env var.
($LOKI_TLS_SKIP_VERIFY)
--cert="" Path to the client certificate. Can also
be set using LOKI_CLIENT_CERT_PATH env var.
($LOKI_CLIENT_CERT_PATH)
--key="" Path to the client certificate key. Can also
be set using LOKI_CLIENT_KEY_PATH env var.
($LOKI_CLIENT_KEY_PATH)
--org-id="" adds X-Scope-OrgID to API requests for
representing tenant ID. Useful for requesting
tenant data when bypassing an auth gateway.
Can also be set using LOKI_ORG_ID env var.
($LOKI_ORG_ID)
--query-tags="" adds X-Query-Tags http header to API requests.
This header value will be part of `metrics.go`
statistics. Useful for tracking the query.
Can also be set using LOKI_QUERY_TAGS env var.
($LOKI_QUERY_TAGS)
--[no-]nocache adds Cache-Control: no-cache http header to API
requests. Can also be set using LOKI_NO_CACHE env
var. ($LOKI_NO_CACHE)
--bearer-token="" adds the Authorization header to API requests for
authentication purposes. Can also be set using
LOKI_BEARER_TOKEN env var. ($LOKI_BEARER_TOKEN)
--bearer-token-file="" adds the Authorization header to API requests
for authentication purposes. Can also be
set using LOKI_BEARER_TOKEN_FILE env var.
($LOKI_BEARER_TOKEN_FILE)
--retries=0 How many times to retry each query when
getting an error response from Loki. Can also
be set using LOKI_CLIENT_RETRIES env var.
($LOKI_CLIENT_RETRIES)
--min-backoff=0 Minimum backoff time between retries. Can also
be set using LOKI_CLIENT_MIN_BACKOFF env var.
($LOKI_CLIENT_MIN_BACKOFF)
--max-backoff=0 Maximum backoff time between retries. Can also
be set using LOKI_CLIENT_MAX_BACKOFF env var.
($LOKI_CLIENT_MAX_BACKOFF)
--auth-header="Authorization"
The authorization header used. Can also
be set using LOKI_AUTH_HEADER env var.
($LOKI_AUTH_HEADER)
--proxy-url="" The http or https proxy to use when
making requests. Can also be set
using LOKI_HTTP_PROXY_URL env var.
($LOKI_HTTP_PROXY_URL)
--[no-]compress Request that Loki compress returned
data in transit. Can also be set
using LOKI_HTTP_COMPRESSION env var.
($LOKI_HTTP_COMPRESSION)
--[no-]envproxy Use ProxyFromEnvironment to use net/http
ProxyFromEnvironment configuration, eg HTTP_PROXY
($LOKI_ENV_PROXY)
--request-id=REQUEST-ID ID of the delete request to cancel
--[no-]force Force cancellation of partially completed request
delete list 명령어 레퍼런스
logcli help delete list의 출력 결과예요:
logcli labels job
delete cancel 명령어 레퍼런스
logcli help delete cancel의 출력 결과예요:
https://logs-dev-ops-tools1.grafana.net/api/prom/label/job/values
loki-ops/consul
loki-ops/loki-gw
--stdin으로 로컬에서 쿼리하기
logcli의 –stdin 인수를 사용하면 Loki 인스턴스가 아니라 로컬 머신에 있는 로그 파일을 대상으로 명령을 실행할 수 있어요. 덕분에 로그 파일을 Loki에 넣지 않고도 LogQL로 조회할 수 있죠. 내려받은 로그 파일을 Loki 밖에서 쿼리해 보고 싶을 때 딱이에요.
로컬 머신에 로그 파일이 있고, 그 파일들에 LogQL 쿼리를 몇 번 돌려 보고 싶은 경우라면 --stdin 플래그가 도움이 돼요.
stdin 플래그로 할 수 있는 일은 다음과 같아요:
- 로그 데이터를 대상으로 LogQL 표현식을 빠르게 테스트하거나 검증하기
- Loki 서버나 Grafana를 따로 준비할 필요 없이, 로컬 로그 파일과
logcli도구만으로 LogQL 기초 익히기 - Loki 인스턴스에 접근하지 않고도 쿼리를 실행해 문제를 진단하기
- 데이터를 Loki에 넣지 않으면서 LogQL로 로컬 로그 파일의 데이터를 파싱·추출하기
- 공개 포럼에서 질문과 답을 주고받고 LogQL 표현식을 공유하며 토론하기
stdin 사용 시 참고 사항
--stdin을 사용할 때는--limit플래그가 아무 의미가 없어요. 대신less같은 페이저를 활용하면 돼요.--stdin을 사용하면 레이블이 존재하지 않는다는 점에 유의하세요. 그래서 쿼리의 스트림 셀렉터는 생략할 수 있어요. 예를 들어|="timeout"|logfmt|level="error"는{foo="bar"}|="timeout|logfmt|level="error"와 같아요.
{{< admonition type="note" >}}
현재 stdin은 어떤 종류의 메트릭 쿼리도 지원하지 않아요.
{{< /admonition >}}
stdin 예시
- 줄 필터 -
cat mylog.log | logcli --stdin query '|="too many open connections"' - 레이블 매처 -
echo 'msg="timeout happened" level="warning"' | logcli --stdin query '|logfmt|level="warning"' - 다양한 파서(logfmt, json, pattern, regexp) -
cat mylog.log | logcli --stdin query '|pattern <ip> - - <_> "<method> <uri> <_>" <status> <size> <_> "<agent>" <_>' - 줄 포매터 -
cat mylog.log | logcli --stdin query '|logfmt|line_format "{{.query}} {{.duration}}"'
배치 처리
logcli는 쿼리 결과가 배치 단위로 도착하도록 Loki에 쿼리를 보내요.
logcli query 명령의 --limit 옵션은 한 번의 쿼리로 돌려받을 로그 줄의 총 개수를 제한해요. 설정하지 않으면 --limit의 기본값은 30이에요. 이 제한은 지정한 쿼리가 대량의 로그 줄을 반환하는 상황에서 Loki에 과부하가 가지 않도록 사용자를 보호해 줘요. 뜻밖에 큰 응답으로부터 사용자를 지켜 주는 역할도 하고요.
결과 집합이 크다면 배치로 나눠 받으면 편해요. --batch 옵션으로 각 배치에 담겨 돌아올 로그 줄 개수를 조절할 수 있어요. 설정하지 않으면 --batch의 기본값은 1000이에요.
--limit 값을 --batch 값보다 크게 설정하면, logcli가 Loki로 보내는 요청들이 배치 단위로 나뉘어요.
Loki에서 쿼리를 실행하면 일정 개수까지만 로그 줄을 돌려줘요. 기본 한도는 5000줄이고, Loki 설정의 limits_config.max_entries_limit_per_query로 이 서버 측 한도를 조정할 수 있어요.
배치 처리를 활용하면 --batch 값이 서버 한도보다 작기만 하다면, 이 서버 측 한도보다 큰 결과 집합도 조회할 수 있어요.
쿼리 메타데이터는 배치마다 stderr로 출력돼요. 이 출력을 끄고 싶다면 logcli query 명령줄에 --quiet 옵션을 주면 돼요.
logcli 예시 쿼리
logcli 사용 예시 몇 가지를 소개할게요.
레이블의 모든 값을 찾아 봐요.
logcli series '{cluster="vinson"}' --analyze-labels
2024/10/31 13:46:25 https://logs-prod-008.grafana.net/loki/api/v1/series?end=1730382385746344416&match=%7Bcluster%3D%22vinson%22%7D&start=1730378785746344416
Total Streams: 10
Unique Labels: 10
Label Name Unique Values Found In Streams
service_name 8 10
pod 7 7
job 6 10
app_kubernetes_io_name 6 6
container 5 7
namespace 3 10
stream 2 7
flags 1 7
instance 1 3
cluster 1 10
모든 레이블과 각 레이블의 고유값을 출력해요. 이 명령은 인덱스에서 높은 카디널리티 레이블을 찾을 때 특히 유용해요.
logcli query '{job="loki-ops/consul"}'
https://logs-dev-ops-tools1.grafana.net/api/prom/query?query=%7Bjob%3D%22loki-ops%2Fconsul%22%7D&limit=30&start=1529928228&end=1529931828&direction=backward®exp=
Common labels: {job="loki-ops/consul", namespace="loki-ops"}
2018-06-25T12:52:09Z {instance="consul-8576459955-pl75w"} 2018/06/25 12:52:09 [INFO] raft: Snapshot to 475409 complete
2018-06-25T12:52:09Z {instance="consul-8576459955-pl75w"} 2018/06/25 12:52:09 [INFO] raft: Compacting logs from 456973 to 465169
특정 스트림에 속한 로그를 모두 가져와요.
logcli series -q --match='{namespace="loki",container_name="loki"}'
{app="loki", container_name="loki", controller_revision_hash="loki-57c9df47f4", filename="/var/log/pods/loki_loki-0_8ed03ded-bacb-4b13-a6fe-53a445a15887/loki/0.log", instance="loki-0", job="loki/loki", name="loki", namespace="loki", release="loki", statefulset_kubernetes_io_pod_name="loki-0", stream="stderr"}
주어진 스트림 셀렉터에 해당하는 모든 로그 스트림을 출력해요. 이 예시는 쿼리와 일치하는 알려진 레이블 조합을 모두 보여줘요.
logcli delete create '{job="app"}' --from="2023-01-01T00:00:00Z" --to="2023-01-02T00:00:00Z"
logcli delete list
특정 기간 동안 특정 job에 속한 로그를 모두 삭제해요:
logcli delete cancel --request-id="abc123"
모든 삭제 요청을 나열해요:
logcli –version
특정 삭제 요청을 취소해요:
limits_config:
query_timeout: 10m
logcli 문제 해결하기
사용 중인 Logcli 버전이 Loki 버전과 일치하는지 먼저 확인하세요. 다음 명령으로 logcli 버전을 확인할 수 있어요:
타임아웃이 자주 발생한다면 logcli-config.yaml 파일에서 다음 설정을 바꿔 보세요.