Grafana Learn
Sign in Sign up
Section 4 · Apply labeling strategy to logs

Three conditions a dynamic label must meet, and filter expressions as the alternative

Estimated time: 1 min

Use dynamic labels sparingly

A dynamic label is a label whose value is extracted from a log line’s content at ingestion or query time, which means the label values can vary. This variance can cause a single stream to split into many streams instead of being fixed, or static. For example, if your app writes level=error into each log line, promoting that value to a level label makes it dynamic. Turning an HTTP status class like 2xx or 5xx from access logs into a label is another common case. Use dynamic labels rarely, and only when all of the following are true:

  • The value set is low-cardinality, ideally tens of values.
  • The values are long lived, such as the first segment of an HTTP path, not ephemeral IDs.
  • Users actually query by the label frequently.

Otherwise, don’t index it. Loki’s filter expressions, which search log content at query time, are fast. {app="api"} |= "level=error" performs comparably to a level label for many workloads, without splitting your streams. Don’t add a label until you know you need it.