> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Querying Logs With LogQL

> How to filter and query application logs using LogQL, covering label selectors, text and regex filters, JSON parsing, and efficient query patterns for Grafana Loki.

In this lesson you'll learn how to filter and query application logs using LogQL (the query language used by Grafana Loki). We'll progress from basic label selectors to text and regex filters, then show how to parse structured JSON log lines and filter by the extracted fields. These building blocks will help you craft precise, efficient queries to find the events you care about.

For more details, see the official LogQL docs: [LogQL — Grafana Loki](https://grafana.com/docs/loki/latest/logql/).

## Basic label selector

A LogQL query starts with a label matcher in braces to select a stream of logs. For example, to select logs from the stream where the label `app` equals `api`:

```logql theme={null}
{app="api"}
```

This returns all log lines whose stream has the label `app="api"`.

Label selectors are the cheapest and most selective filters you can apply. Always start by narrowing streams with label matchers before adding pipeline filters.

## Filtering by text (contains)

After selecting a stream, use pipeline operators to filter the content of log lines. Use `|=` to include only lines that contain a substring. Example: show only log lines that contain the word `DELETE`:

```logql theme={null}
{app="api"} |= "DELETE"
```

Sample output (truncated):

```text theme={null}
54 lines displayed  Total bytes processed: 7.11 kB  Common labels: app=api container=api instance=default/api-68b9dbd6b5... +4

2026-07-29 18:07:35.593  UNK  {
  "level": 30,
  "time": 1785337655592,
  "pid": 1,
  "hostname": "api-68b9dbd6b5-hxp22",
  "method": "DELETE",
  "route": "/cart",
  "code": "401"
}
2026-07-29 18:07:34.592  UNK  {
  "level": 30,
  "time": 1785337654591,
  "pid": 1,
  "hostname": "api-68b9dbd6b5-hxp22",
  "method": "GET",
  "route": "/cart",
  "code": "401"
}
```

### Filtering by route or other substrings

You can filter any substring in the line. For example, to find requests to the `/users` route:

```logql theme={null}
{app="api"} |= "/users"
```

## Negation (exclude matches)

To exclude lines that contain a substring use the not-equals pipeline operator `!=`:

```logql theme={null}
{app="api"} != "GET"
```

For regex negation (exclude lines matching a regex) use `!~`:

```logql theme={null}
{app="api"} !~ "GET|POST"
```

## Regular expression matching

To filter lines that match a regex, use the match operator `|~`. For example, to keep only `GET` or `POST` entries:

```logql theme={null}
{app="api"} |~ "GET|POST"
```

To invert that (everything that is not `GET` or `POST`):

```logql theme={null}
{app="api"} !~ "GET|POST"
```

## Quick reference: common pipeline operators

| Operator | Meaning | Example |
| - | - | - |
| `\|=` | Include lines that contain substring | `{app="api"} \|= "DELETE"` |
| `!=` | Exclude lines that contain substring | `{app="api"} != "GET"` |
| `\|~` | Include lines matching regex | `{app="api"} \|~ "GET\|POST"` |
| `!~` | Exclude lines matching regex | `{app="api"} !~ "GET\|POST"` |
| `\| json` | Parse each line as JSON and extract top-level fields | `{app="api"} \| json` |

## Parsing JSON log lines and filtering extracted fields

When your logs are structured JSON, parse them with the `| json` pipeline stage. This extracts top-level JSON fields and makes them available for direct comparisons.

For example, to find entries whose parsed `code` field equals `500` while excluding `GET`/`POST` methods:

```logql theme={null}
{app="api"} !~ "GET|POST" | json | code = "500"
```

Example JSON log entries (parsed by `| json`):

```json theme={null}
{
  "level": 50,
  "time": 1785337849784,
  "pid": 1,
  "hostname": "api-68b9dbd6b5-hxp22",
  "method": "DELETE",
  "route": "/users",
  "code": "500"
}

{
  "level": 60,
  "time": 1785337842777,
  "pid": 1,
  "hostname": "api-68b9dbd6b5-hxp22",
  "method": "DELETE",
  "route": "/users",
  "code": "500"
}
```

Avoid parsing every log line with `| json` if you only need a subset — parse after applying text/regex filters to reduce processing. Also be cautious with broad regexes; they can be expensive and slow queries.

## Putting it all together

The general pattern is:

1. Use label matchers to narrow to the relevant stream(s).
2. Apply pipeline operators (`|=`, `!=`, `|~`, `!~`) to include/exclude by text or regex.
3. Use `| json` to parse structured logs, then filter on extracted fields.

Common query examples:

```logql theme={null}
# All api logs containing "DELETE"
{app="api"} |= "DELETE"

# Only GET or POST requests
{app="api"} |~ "GET|POST"

# Non-GET/POST requests parsed as JSON where code == 500
{app="api"} !~ "GET|POST" | json | code = "500"
```

These building blocks let you compose precise LogQL queries to quickly locate relevant events.

## Links and references

* [LogQL — Grafana Loki](https://grafana.com/docs/loki/latest/logql/)
* [Grafana Loki Documentation](https://grafana.com/docs/loki/)
* [Loki Query Examples & Best Practices](https://grafana.com/docs/loki/latest/logql/basics/)

> **[Watch Video](https://learn.kodekloud.com/user/courses/grafana-loki/module/595f27e5-031e-46ea-bffc-ee1a15f73837/lesson/b5971dc5-7cc7-462e-9f04-5626e3d5cd08)**

> **[Practice Lab](https://learn.kodekloud.com/user/courses/grafana-loki/module/595f27e5-031e-46ea-bffc-ee1a15f73837/lesson/d378c104-4d90-4f28-98c0-a37bc065ad4e)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.