Chapter 1. LokiStack data model and log format

Loki organizes logs into the following components:

The log collector automatically extracts the following fields as Loki labels:

For infrastructure journal logs, the collector also extracts:

For audit logs, the collector extracts:

After label extraction, the log collector serializes the remaining fields as the log line content. For structured logs, this is JSON. For plain text logs, this is the message string.

The following OpenShift log record:

{
  "kubernetes": {
    "namespace_name": "my-app",
    "pod_name": "web-1",
    "container_name": "nginx",
    "host": "ip-10-0-1-42.ec2.internal"
  },
  "message": "Error connecting to database",
  "level": "error",
  "@timestamp": "2024-01-15T10:30:00.000Z"
}

The log collector transforms this into a Loki stream entry:

Labels:

{
  log_type="application",
  kubernetes_namespace_name="my-app",
  kubernetes_pod_name="web-1",
  kubernetes_container_name="nginx",
  kubernetes_host="ip-10-0-1-42.ec2.internal"
}

Log line (remaining fields as JSON):

{
  "message": "Error connecting to database",
  "level": "error",
  "@timestamp": "2024-01-15T10:30:00.000Z"
}

Timestamp: 2024-01-15T10:30:00.000Z

The following infrastructure log from systemd journal:

{
  "message": "Started container",
  "systemd": {
    "t": {
      "SYSTEMD_UNIT": "kubelet.service"
    }
  },
  "hostname": "ip-10-0-1-42.ec2.internal",
  "@timestamp": "2024-01-15T10:30:00.000Z"
}

The log collector transforms this into a Loki stream entry:

Labels:

{
  log_type="infrastructure",
  systemd_unit="kubelet.service",
  kubernetes_host="ip-10-0-1-42.ec2.internal"
}

Log line:

{
  "message": "Started container",
  "@timestamp": "2024-01-15T10:30:00.000Z"
}

Use LogQL to query logs in Loki. Labels enable efficient stream selection:

{log_type="application", kubernetes_namespace_name="my-app"}

{kubernetes_namespace_name="my-app", kubernetes_pod_name="web-1"}

{log_type="infrastructure", systemd_unit="kubelet.service"}

After selecting streams by labels, you can filter log lines by content:

{log_type="application"} |= "error"

{log_type="application"} | json | level="error"