Writing Log Queries

# Basic log line filter
{app="api"} |= "error"

# Parse and extract fields
{app="nginx"} | json | status >= 500

# Calculate rates
sum(rate({app="api"} |~ "error" [5m])) by (pod)

# Basic search
kubernetes.container.name: "api" and message: "error"

# Time range
@timestamp >= now-15m and @timestamp <= now()

# Find errors with stack traces
{app="backend"} |~ "(?i)error|exception|fail"

# Slow API responses
{app="api"} | json | duration > 1000