Query acceleration (Experimental)
Warning
Query acceleration using blooms is an experimental feature. Engineering and on-call support is not available. No SLA is provided.
If bloom filters are enabled, you can write LogQL queries using structured metadata to benefit from query acceleration.
Prerequisites
- Bloom filters must be enabled.
- Logs must be sending structured metadata.
Query blooms
Queries will be accelerated for any label filter expression that satisfies all of the following criteria:
- The label filter expression using string equality, such as
| key="value"
. - The label filter expression is querying for structured metadata and not a stream label.
- The label filter expression is placed before any parser expression, labels format expression, drop labels expression, or keep labels expression.
To take full advantage of query acceleration with blooms, ensure that filtering structured metadata is done before any parse expression:
{cluster="prod"} | logfmt | json | detected_level="error" # NOT ACCELERATED: structured metadata filter is after a parse stage
{cluster="prod"} | detected_level="error" | logfmt | json # ACCELERATED: structured metadata filter is before any parse stage