Slide 2 of 5

Use dynamic labels sparingly

Use dynamic labels sparingly

A dynamic label is a label whose value is extracted from a log line’s content at ingestion or query time, which means the label values can vary. This variance can cause a single stream to split into many streams instead of being fixed, or static. For example, if your app writes level=error into each log line, promoting that value to a level label makes it dynamic. Turning an HTTP status class like 2xx or 5xx from access logs into a label is another common case. Use dynamic labels rarely, and only when all of the following are true:

  • The value set is low-cardinality, ideally tens of values.
  • The values are long lived, such as the first segment of an HTTP path, not ephemeral IDs.
  • Users actually query by the label frequently.

Otherwise, don’t index it. Loki’s filter expressions, which search log content at query time, are fast. {app="api"} |= "level=error" performs comparably to a level label for many workloads, without splitting your streams. Don’t add a label until you know you need it.

Script

The previous slide covered labels that describe origin. A dynamic label is different. Its value is extracted from the log line’s content, so the value can vary from line to line, and that variance splits what would be a single stream into many.

Promoting level equals error from your log lines into a level label is a classic example. Turning an HTTP status class, like the 200s or the 500s, into a label is another common one.

Dynamic labels earn their place only when three things are all true. The value set is low-cardinality, ideally tens of values. The values are long lived, not ephemeral IDs. And users actually query by the label frequently.

Otherwise, don’t index it. Loki’s filter expressions search log content at query time, and they perform comparably to a level label for many workloads without splitting your streams. Don’t add a label until you know you need it.

Previous Next