How to search logs in Loki without worrying about the case
Whether it’s during an incident to find the root cause of the problem or during development to troubleshoot what your code is doing, at some point you’ll have an issue that requires you to search for the proverbial needle in your haystack of logs.
Loki’s main use case is to search logs within your system. The best way to do this is to use LogQL’s line filters. However, most operators are case sensitive.
This means that if you’re not sure if the errors you’re searching for have some capital letters or where those capital letters may appear, searching your logs becomes tricky. It becomes even more difficult since filters are applied together as and operations, so you can’t combine multiple filters in the attempt to match different cases (e.g {app=”loki”} |= “error” |= “Error” ) since they all need to match.
A better working solution is to use the regex line filters such as !~ and |~, which supports RE2 regex syntax. Indeed RE2 supports case-insensitive flag ((?i)) which allows you to search for a word or an expression without worrying about case.
For example:
{app=”loki”} |~ “(?i)error”will match any logs that contain: error, Error, ErRor or whatever your colleagues creatively put together.
Last, but not least, don’t worry about performance. Loki optimizes such regex expressions away and will simplify them. In fact, it won’t even execute a regex search but simply a case insensitive search. You can learn more about how we do that in my previous blog post.
In short, LogQL’s line filters are the fastest way to search logs in Loki. If you need to run a case-insensitive search you can take advantage of RE2 case-insensitive flag (?i) without a performance penalty.
The best way to get started with Loki? Sign up for Grafana Cloud for free. Grafana Cloud is the easiest way to get started observing metrics, logs, traces, and dashboards, and we have free and paid plans to suit every use case.
