mirror of https://github.com/grafana/loki
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
266 lines
13 KiB
266 lines
13 KiB
|
5 years ago
|
---
|
||
|
|
title: LogCLI
|
||
|
|
---
|
||
|
6 years ago
|
# Querying Loki with LogCLI
|
||
|
7 years ago
|
|
||
|
6 years ago
|
If you prefer a command line interface, LogCLI also allows users to run LogQL
|
||
|
|
queries against a Loki server.
|
||
|
7 years ago
|
|
||
|
|
## Installation
|
||
|
|
|
||
|
6 years ago
|
### Binary (Recommended)
|
||
|
6 years ago
|
|
||
|
6 years ago
|
Every release includes binaries for `logcli` which can be found on the
|
||
|
|
[Releases page](https://github.com/grafana/loki/releases).
|
||
|
7 years ago
|
|
||
|
6 years ago
|
### From source
|
||
|
7 years ago
|
|
||
|
6 years ago
|
Use `go get` to install `logcli` to `$GOPATH/bin`:
|
||
|
|
|
||
|
7 years ago
|
```
|
||
|
6 years ago
|
$ go get github.com/grafana/loki/cmd/logcli
|
||
|
7 years ago
|
```
|
||
|
|
|
||
|
|
## Usage
|
||
|
|
|
||
|
|
### Example
|
||
|
|
|
||
|
6 years ago
|
If you are running on Grafana Cloud, use:
|
||
|
|
|
||
|
|
```bash
|
||
|
6 years ago
|
$ export LOKI_ADDR=https://logs-us-west1.grafana.net
|
||
|
|
$ export LOKI_USERNAME=<username>
|
||
|
|
$ export LOKI_PASSWORD=<password>
|
||
|
6 years ago
|
```
|
||
|
6 years ago
|
|
||
|
|
Otherwise you can point LogCLI to a local instance directly
|
||
|
|
without needing a username and password:
|
||
|
|
|
||
|
|
```bash
|
||
|
6 years ago
|
$ export LOKI_ADDR=http://localhost:3100
|
||
|
6 years ago
|
```
|
||
|
6 years ago
|
|
||
|
|
> Note: If you are running Loki behind a proxy server and you have
|
||
|
6 years ago
|
> authentication configured, you will also have to pass in LOKI_USERNAME
|
||
|
|
> and LOKI_PASSWORD accordingly.
|
||
|
6 years ago
|
|
||
|
6 years ago
|
```bash
|
||
|
7 years ago
|
$ logcli labels job
|
||
|
|
https://logs-dev-ops-tools1.grafana.net/api/prom/label/job/values
|
||
|
|
cortex-ops/consul
|
||
|
|
cortex-ops/cortex-gw
|
||
|
|
...
|
||
|
6 years ago
|
|
||
|
7 years ago
|
$ logcli query '{job="cortex-ops/consul"}'
|
||
|
6 years ago
|
https://logs-dev-ops-tools1.grafana.net/api/prom/query?query=%7Bjob%3D%22cortex-ops%2Fconsul%22%7D&limit=30&start=1529928228&end=1529931828&direction=backward®exp=
|
||
|
7 years ago
|
Common labels: {job="cortex-ops/consul", namespace="cortex-ops"}
|
||
|
|
2018-06-25T12:52:09Z {instance="consul-8576459955-pl75w"} 2018/06/25 12:52:09 [INFO] raft: Snapshot to 475409 complete
|
||
|
|
2018-06-25T12:52:09Z {instance="consul-8576459955-pl75w"} 2018/06/25 12:52:09 [INFO] raft: Compacting logs from 456973 to 465169
|
||
|
6 years ago
|
...
|
||
|
|
|
||
|
|
$ logcli series -q --match='{namespace="loki",container_name="loki"}'
|
||
|
|
{app="loki", container_name="loki", controller_revision_hash="loki-57c9df47f4", filename="/var/log/pods/loki_loki-0_8ed03ded-bacb-4b13-a6fe-53a445a15887/loki/0.log", instance="loki-0", job="loki/loki", name="loki", namespace="loki", release="loki", statefulset_kubernetes_io_pod_name="loki-0", stream="stderr"}
|
||
|
7 years ago
|
```
|
||
|
7 years ago
|
|
||
|
|
### Configuration
|
||
|
|
|
||
|
7 years ago
|
Configuration values are considered in the following order (lowest to highest):
|
||
|
7 years ago
|
|
||
|
6 years ago
|
- Environment variables
|
||
|
|
- Command line flags
|
||
|
7 years ago
|
|
||
|
7 years ago
|
### Details
|
||
|
7 years ago
|
|
||
|
6 years ago
|
```nohighlight
|
||
|
7 years ago
|
$ logcli help
|
||
|
|
usage: logcli [<flags>] <command> [<args> ...]
|
||
|
|
|
||
|
|
A command-line for loki.
|
||
|
|
|
||
|
|
Flags:
|
||
|
6 years ago
|
--help Show context-sensitive help (also try --help-long and --help-man).
|
||
|
6 years ago
|
--version Show application version.
|
||
|
6 years ago
|
-q, --quiet Suppress query metadata
|
||
|
|
--stats Show query statistics
|
||
|
|
-o, --output=default Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.
|
||
|
6 years ago
|
-z, --timezone=Local Specify the timezone to use when formatting output timestamps [Local, UTC]
|
||
|
6 years ago
|
--cpuprofile="" Specify the location for writing a CPU profile.
|
||
|
|
--memprofile="" Specify the location for writing a memory profile.
|
||
|
|
--addr="http://localhost:3100"
|
||
|
6 years ago
|
Server address. Can also be set using LOKI_ADDR env var.
|
||
|
|
--username="" Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.
|
||
|
|
--password="" Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.
|
||
|
|
--ca-cert="" Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.
|
||
|
6 years ago
|
--tls-skip-verify Server certificate TLS skip verify.
|
||
|
6 years ago
|
--cert="" Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.
|
||
|
|
--key="" Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.
|
||
|
6 years ago
|
--org-id="" adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when
|
||
|
|
bypassing an auth gateway.
|
||
|
7 years ago
|
|
||
|
|
Commands:
|
||
|
|
help [<command>...]
|
||
|
|
Show help.
|
||
|
|
|
||
|
6 years ago
|
query [<flags>] <query>
|
||
|
7 years ago
|
Run a LogQL query.
|
||
|
|
|
||
|
6 years ago
|
The "query" command is useful for querying for logs. Logs can be returned in a few output modes:
|
||
|
6 years ago
|
|
||
|
|
raw: log line
|
||
|
|
default: log timestamp + log labels + log line
|
||
|
|
jsonl: JSON response from Loki API of log line
|
||
|
|
|
||
|
6 years ago
|
The output of the log can be specified with the "-o" flag, for example, "-o raw" for the raw output format.
|
||
|
6 years ago
|
|
||
|
6 years ago
|
The "query" command will output extra information about the query and its results, such as the API URL, set of common labels,
|
||
|
|
and set of excluded labels. This extra information can be suppressed with the --quiet flag.
|
||
|
6 years ago
|
|
||
|
6 years ago
|
While "query" does support metrics queries, its output contains multiple data points between the start and end query time.
|
||
|
|
This output is used to build graphs, like what is seen in the Grafana Explore graph view. If you are querying metrics and just
|
||
|
|
want the most recent data point (like what is seen in the Grafana Explore table view), then you should use the "instant-query"
|
||
|
|
command instead.
|
||
|
6 years ago
|
|
||
|
|
instant-query [<flags>] <query>
|
||
|
|
Run an instant LogQL query.
|
||
|
|
|
||
|
6 years ago
|
The "instant-query" command is useful for evaluating a metric query for a single point in time. This is equivalent to the
|
||
|
|
Grafana Explore table view; if you want a metrics query that is used to build a Grafana graph, you should use the "query"
|
||
|
|
command instead.
|
||
|
6 years ago
|
|
||
|
6 years ago
|
This command does not produce useful output when querying for log lines; you should always use the "query" command when you
|
||
|
|
are running log queries.
|
||
|
6 years ago
|
|
||
|
6 years ago
|
For more information about log queries and metric queries, refer to the LogQL documentation:
|
||
|
6 years ago
|
|
||
|
|
https://github.com/grafana/loki/blob/master/docs/logql.md
|
||
|
|
|
||
|
6 years ago
|
labels [<flags>] [<label>]
|
||
|
7 years ago
|
Find values for a given label.
|
||
|
|
|
||
|
6 years ago
|
series --match=MATCH [<flags>]
|
||
|
|
Run series query.
|
||
|
|
|
||
|
7 years ago
|
$ logcli help query
|
||
|
6 years ago
|
usage: logcli query [<flags>] <query>
|
||
|
7 years ago
|
|
||
|
|
Run a LogQL query.
|
||
|
|
|
||
|
6 years ago
|
The "query" command is useful for querying for logs. Logs can be returned in a few output modes:
|
||
|
|
|
||
|
|
raw: log line
|
||
|
|
default: log timestamp + log labels + log line
|
||
|
|
jsonl: JSON response from Loki API of log line
|
||
|
|
|
||
|
|
The output of the log can be specified with the "-o" flag, for example, "-o raw" for the raw output format.
|
||
|
|
|
||
|
|
The "query" command will output extra information about the query and its results, such as the API URL, set of common labels, and
|
||
|
|
set of excluded labels. This extra information can be suppressed with the --quiet flag.
|
||
|
|
|
||
|
|
While "query" does support metrics queries, its output contains multiple data points between the start and end query time. This
|
||
|
|
output is used to build graphs, like what is seen in the Grafana Explore graph view. If you are querying metrics and just want the
|
||
|
|
most recent data point (like what is seen in the Grafana Explore table view), then you should use the "instant-query" command
|
||
|
|
instead.
|
||
|
|
|
||
|
7 years ago
|
Flags:
|
||
|
6 years ago
|
--help Show context-sensitive help (also try --help-long and --help-man).
|
||
|
|
--version Show application version.
|
||
|
|
-q, --quiet Suppress query metadata
|
||
|
|
--stats Show query statistics
|
||
|
|
-o, --output=default Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.
|
||
|
|
-z, --timezone=Local Specify the timezone to use when formatting output timestamps [Local, UTC]
|
||
|
|
--cpuprofile="" Specify the location for writing a CPU profile.
|
||
|
|
--memprofile="" Specify the location for writing a memory profile.
|
||
|
|
--addr="http://localhost:3100"
|
||
|
|
Server address. Can also be set using LOKI_ADDR env var.
|
||
|
|
--username="" Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.
|
||
|
|
--password="" Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.
|
||
|
|
--ca-cert="" Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.
|
||
|
|
--tls-skip-verify Server certificate TLS skip verify.
|
||
|
|
--cert="" Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.
|
||
|
|
--key="" Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.
|
||
|
|
--org-id="" adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when
|
||
|
|
bypassing an auth gateway.
|
||
|
|
--limit=30 Limit on number of entries to print.
|
||
|
|
--since=1h Lookback window.
|
||
|
|
--from=FROM Start looking for logs at this absolute time (inclusive)
|
||
|
|
--to=TO Stop looking for logs at this absolute time (exclusive)
|
||
|
|
--step=STEP Query resolution step width, for metric queries. Evaluate the query at the specified step over the time
|
||
|
|
range.
|
||
|
|
--interval=INTERVAL Query interval, for log queries. Return entries at the specified interval, ignoring those between.
|
||
|
|
**This parameter is experimental, please see Issue 1779**
|
||
|
|
--forward Scan forwards through logs.
|
||
|
|
--no-labels Do not print any labels
|
||
|
|
--exclude-label=EXCLUDE-LABEL ...
|
||
|
|
Exclude labels given the provided key during output.
|
||
|
|
--include-label=INCLUDE-LABEL ...
|
||
|
|
Include labels given the provided key during output.
|
||
|
|
--labels-length=0 Set a fixed padding to labels
|
||
|
|
--store-config="" Execute the current query using a configured storage from a given Loki configuration file.
|
||
|
|
-t, --tail Tail the logs
|
||
|
|
--delay-for=0 Delay in tailing by number of seconds to accumulate logs for re-ordering
|
||
|
7 years ago
|
|
||
|
|
Args:
|
||
|
6 years ago
|
<query> eg '{foo="bar",baz=~".*blip"} |~ ".*error.*"'
|
||
|
6 years ago
|
|
||
|
|
$ logcli help labels
|
||
|
6 years ago
|
usage: logcli labels [<flags>] [<label>]
|
||
|
6 years ago
|
|
||
|
|
Find values for a given label.
|
||
|
|
|
||
|
|
Flags:
|
||
|
|
--help Show context-sensitive help (also try --help-long and --help-man).
|
||
|
|
--version Show application version.
|
||
|
6 years ago
|
-q, --quiet Suppress query metadata
|
||
|
|
--stats Show query statistics
|
||
|
|
-o, --output=default Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.
|
||
|
6 years ago
|
-z, --timezone=Local Specify the timezone to use when formatting output timestamps [Local, UTC]
|
||
|
6 years ago
|
--cpuprofile="" Specify the location for writing a CPU profile.
|
||
|
|
--memprofile="" Specify the location for writing a memory profile.
|
||
|
|
--addr="http://localhost:3100"
|
||
|
6 years ago
|
Server address. Can also be set using LOKI_ADDR env var.
|
||
|
|
--username="" Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.
|
||
|
|
--password="" Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.
|
||
|
|
--ca-cert="" Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.
|
||
|
|
--tls-skip-verify Server certificate TLS skip verify.
|
||
|
|
--cert="" Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.
|
||
|
|
--key="" Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.
|
||
|
6 years ago
|
--org-id="" adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when
|
||
|
|
bypassing an auth gateway.
|
||
|
6 years ago
|
--since=1h Lookback window.
|
||
|
|
--from=FROM Start looking for labels at this absolute time (inclusive)
|
||
|
|
--to=TO Stop looking for labels at this absolute time (exclusive)
|
||
|
6 years ago
|
|
||
|
|
Args:
|
||
|
|
[<label>] The name of the label.
|
||
|
|
|
||
|
|
$ logcli help series
|
||
|
|
usage: logcli series --match=MATCH [<flags>]
|
||
|
|
|
||
|
|
Run series query.
|
||
|
|
|
||
|
|
Flags:
|
||
|
|
--help Show context-sensitive help (also try --help-long and --help-man).
|
||
|
|
--version Show application version.
|
||
|
6 years ago
|
-q, --quiet Suppress query metadata
|
||
|
|
--stats Show query statistics
|
||
|
|
-o, --output=default Specify output mode [default, raw, jsonl]. raw suppresses log labels and timestamp.
|
||
|
6 years ago
|
-z, --timezone=Local Specify the timezone to use when formatting output timestamps [Local, UTC]
|
||
|
6 years ago
|
--cpuprofile="" Specify the location for writing a CPU profile.
|
||
|
|
--memprofile="" Specify the location for writing a memory profile.
|
||
|
|
--addr="http://localhost:3100"
|
||
|
6 years ago
|
Server address. Can also be set using LOKI_ADDR env var.
|
||
|
|
--username="" Username for HTTP basic auth. Can also be set using LOKI_USERNAME env var.
|
||
|
|
--password="" Password for HTTP basic auth. Can also be set using LOKI_PASSWORD env var.
|
||
|
|
--ca-cert="" Path to the server Certificate Authority. Can also be set using LOKI_CA_CERT_PATH env var.
|
||
|
|
--tls-skip-verify Server certificate TLS skip verify.
|
||
|
|
--cert="" Path to the client certificate. Can also be set using LOKI_CLIENT_CERT_PATH env var.
|
||
|
|
--key="" Path to the client certificate key. Can also be set using LOKI_CLIENT_KEY_PATH env var.
|
||
|
6 years ago
|
--org-id="" adds X-Scope-OrgID to API requests for representing tenant ID. Useful for requesting tenant data when
|
||
|
|
bypassing an auth gateway.
|
||
|
6 years ago
|
--since=1h Lookback window.
|
||
|
|
--from=FROM Start looking for logs at this absolute time (inclusive)
|
||
|
|
--to=TO Stop looking for logs at this absolute time (exclusive)
|
||
|
|
--match=MATCH ... eg '{foo="bar",baz=~".*blip"}'
|
||
|
|
|
||
|
7 years ago
|
```
|