Grafana Loki LogQL

{app="nginx"} |= "500"

LogQL search in Grafana Loki that filters application logs (nginx) by content, the quick way to search for errors and patterns.

Run it in Grafana when application logs live in Loki and you need to filter by content: the query {app="nginx"} selects the app's streams and |= "500" filters lines containing the pattern. It's the distributed grep for logs: the same structure works for searching application errors, exploitation attempts (SQLi patterns, weird paths) or any string. In an IR, Loki is the first stop to see what happened in an app before the incident — and LogQL allows everything from simple filtering to time-based aggregations (rate, count_over_time) to spot spikes.

Don't use it for searches over untagged logs: LogQL filters by stream labels ({app=...}) and then by content — without labels properly set at ingestion, stream selection is impossible or returns everything. The |= filter is substring-based: complex patterns (regex) use |~, and aggregations require range functions (rate, count_over_time) with the window. And watch performance: content searches over wide ranges without label filters are expensive — narrow down by labels and time window. Loki doesn't index content: each search scans chunks, so label filtering is the key to cost.