How to search multiple strings in same entry in Loki

Question

Im trying to filter out log entries which matche two strings given. The log entries are not json compatible so it cannot be parsed to json. Example log entry looks like

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [customer : 20] some other text[player : 123456]

I'm trying to filter all the entries which has both customer: 20 and player : 123456.

I tried

{app="xx",filename="xx.log"} |~ "(.*customer : 20 | player : 123456.*)" 
{app="xx",filename="xx.log"} |~ "(customer : 20 | player : 123456)" 
{app="xx",filename="xx.log"} |~ ".*customer : 20.* .*player : 123456*."

but none of these above helped me to get the entries which has both these values. any idea ? Thanks

It is pity that it is hard to construct LogQL query for such a trivial task :( I'd like if Loki would support [LogsQL](https://docs.victoriametrics.com/VictoriaLogs/LogsQL.html) syntax. Then the needed query could be as simple as `"customer: 20" "player: 123456"` — valyala, Jul 08 '23 at 06:59

score 0 · Answer 1 · answered May 18 '23 at 21:22

I think you just need to specify the filter message that you wanted, and accept any string in between your targeted message string.

You can try this filter:

{app="xx",filename="xx.log"} |~".*customer : 20.*player : 123456.*|.*player : 123456.*customer : 20.*"

Basically this one will match any log that contain customer : 20 and player : 123456 in any order which one is first and which one is last. Example matched log:

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [customer : 20] some other text[player : 123456]

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [player : 123456] some other 2 text[customer : 20]

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [customer : 20][player : 123456] some other 3 text

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [player : 123456][customer : 20] some other 4 text

but this will not match this log

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [customer: 20] some other text[player: 123456]

because the specified string is customer : 20 (with space) but the log is not having space customer: 20. Same with the player text.

But, if you don't want to add the ability to switch place of the string customer : 20 and player : 123456 you can simpliy use this filter:

{app="xx",filename="xx.log"} |~".*customer : 20.*player : 123456.*"

This will only match this kind of log:

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [customer : 20] some other text[player : 123456]

[INFO ] (-Worker-10) com.xx.yy.logging.UserLog  Ys5morE1Kd8AkGxysKiNQgAAAsY - [customer : 20][player : 123456] some other 3 text

How to search multiple strings in same entry in Loki

1 Answers1