Write a Grafana Loki LogQL pipeline with multiple parsing stages, label filters, and a metric query to alert on error rate
domain: grafana.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Start with a stream selector {app="myservice", env="production"} and pipe through a JSON or logfmt parser to extract structured fields
Apply a label filter |= "level=error" or | level = "error" after parsing to retain only error-level log lines
Use a line_format template to reshape log output for readability in the Loki Explore view
Convert the log query to a metric query using sum(rate({app="myservice"}|json|level="error"[5m])) by (service) for use in a Grafana alert rule
Configure a Grafana alert rule using the Loki datasource with the metric query and set a threshold on the error rate
Known gotchas
Loki label filters applied before a parser stage operate on stream labels only; filters on extracted fields must come after the parser stage in the pipeline
Loki metric queries using rate() require the range vector to be at least as large as the scrape or push interval; too-small ranges produce zero values
Adding extracted fields as labels using | label_format or label creates new streams; each unique value of a high-cardinality extracted field becomes a separate stream causing excessive cardinality
Give your agent this knowledge — and 6,400+ more routes
One MCP install gives any agent live access to the full route map across 2,100+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp