LogQL workflows

Use this guide to discover log patterns quickly with the Assistant. It walks you from framing the search to delivering usable summaries.

What you’ll achieve

Express log queries in natural language and let the Assistant generate the correct LogQL.
Layer in parsing, filtering, and aggregation to narrow results and extract insights.
Pivot to related queries or tooling, such as Tempo traces, without losing context.

Before you begin

Loki data source: Mention the data source with @ so the Assistant scopes the query correctly.
Relevant labels: Identify Kubernetes labels, application tags, or log levels ahead of time.

Frame the search

Describe the log stream, timeframe, and filters you care about so the Assistant can assemble the initial LogQL selector.

Provide the stream selector and desired filters in natural language. Share example label values or log snippets so the Assistant honors the exact pattern you care about.

Find logs from @loki-logs where job="checkout" and level="error" in the last 15 minutes.

Ask for parsing when structured fields exist:

Parse the JSON payload and show the top five error codes.

Add transformations

Layer parsing, filtering, and aggregation onto the base query to highlight the most relevant log patterns.

Request label filters, line filtering, or parsing in the follow-up prompt.
Ask the Assistant to convert repeated pipeline stages into a single optimized query.
Capture summaries for incident updates, for example, Summarize the repeated error message and include sample log lines.
If the response goes off track, correct it politely with the missing label or filter before moving to the next step.

Pivot to other tools

Move from logs to complementary tooling—such as Explore sessions or Tempo traces—without losing the context you established.

Ask the Assistant to open Explore with the generated query so you can continue interactively.
Request a drilldown to Tempo when trace IDs appear in the logs, for example, Follow the trace_id field to Tempo and show the slowest spans.

You now have a refined LogQL query, a summary of key findings, and optionally a handoff to related tools. Save the outputs in your incident notes or attach them to dashboards.

Troubleshooting

No results: verify the labels and timeframe. Ask the Assistant to list available labels, for example, List label values for job in @loki-logs.
Syntax errors: request validation and correction, for example, Validate this LogQL query and fix the syntax.
Too much data: add rate limits or narrower filters, for example, Limit to the top 100 matches sorted by timestamp.
Jumping to a new log source: start a new conversation so the previous selector does not influence the next query.