Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(logql): Support drop labels in logql pipeline #7975

Merged
merged 25 commits into from
Jan 12, 2023

Conversation

adityacs
Copy link
Contributor

@adityacs adityacs commented Dec 20, 2022

What this PR does / why we need it:
This PR introduces drop stage in logql pipeline.

Which issue(s) this PR fixes:
Fixes #7870, Fixes #7368

Checklist

  • Reviewed the CONTRIBUTING.md guide
  • Documentation added
  • Tests updated
  • CHANGELOG.md updated
  • Changes that require user attention or interaction to upgrade are documented in docs/sources/logql/log_queries.md

@adityacs adityacs requested a review from a team as a code owner December 20, 2022 09:42
@github-actions github-actions bot added the type/docs Issues related to technical documentation; the Docs Squad uses this label across many repositories label Dec 20, 2022
Copy link
Member

@owen-d owen-d left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can already use | __error__="" to ignore errors and | label_format x="{{.__error__}}" to extract errors to new labels, but I'm definitely interested in a way to remove existing labels. It sounds like your label_format_rename_errors is a nice syntactic sugar for a combination of these.

Would it make more sense to start with a | strip <label> <label> operation which could remove labels from the results? I think this would result in cleaner code as well since we wouldn't have to have special cases for the __error__ label besides preventing it from being rewritten (current behavior).

@adityacs
Copy link
Contributor Author

adityacs commented Jan 5, 2023

@owen-d

We can already use | error="" to ignore errors and | label_format x="{{.error}}" to extract errors to new labels

__error__="" drops the lines which contains the error. With ignore_errors we are just removing the __error__ label but keeping the line.

With label_format dst={{__error__}}, we can extract but we are trying to remove __error__ label here. Instead of just removing, with label_format_rename_error, we can capture the error with different key.

Would it make more sense to start with a | strip operation which could remove labels from the results? I think this would result in cleaner code as well since we wouldn't have to have special cases for the error label besides preventing it from being rewritten (current behavior).

I am totally ok with this. This would be a nice approach. However, I think we should still support renaming __error__ labels(with label_format or label_format_rename_errors), this would allow user to know there was an error in that line. If the user wants to remove or ignore the errors, we could support strip <label> instead of ignore_errors.

@owen-d
Copy link
Member

owen-d commented Jan 5, 2023

error="" drops the lines which contains the error. With ignore_errors we are just removing the error label but keeping the line.

Good distinction there 👍 .

I think we could achieve what you're suggesting with something like

| label_format dst={{__error__}} | strip __error__

This would be a little more verbose, but it won't have to treat the __error__ label in a special way and could be used for other use cases, which I like. WDYT?

@adityacs
Copy link
Contributor Author

adityacs commented Jan 5, 2023

| label_format dst={{__error__}} | strip __error__

Yes, this would do.

Should we say label_remove or label_drop or srtrip_label which would be more intuitive instead of strip?

Also, should we support strip with a match condition i.e. strip labels only if it matches some value? Something like|strip __error__=JSONParserErr.

@owen-d
Copy link
Member

owen-d commented Jan 5, 2023

I'm inclined to use | drop <label> <label> and | drop <label>=<match> <label>=<match>

@adityacs
Copy link
Contributor Author

adityacs commented Jan 6, 2023

| drop <label> <label> and | drop <label>=<match> <label>=<match>
Yes, this works. Will make changes accordingly.

@adityacs adityacs changed the title feat(logql): add ignore_errors and label_format_rename_errors stages in logql pipeline feat(logql): Support drop labels in logql pipeline Jan 10, 2023
@grafanabot
Copy link
Collaborator

./tools/diff_coverage.sh ../loki-target-branch/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

@adityacs adityacs requested a review from owen-d January 10, 2023 12:08
@adityacs
Copy link
Contributor Author

@owen-d Not sure if we should support __error__details__ explicitly. For match expression it would be too verbose to match by __error_details__. For example, something like this would be too verbose |drop __error_details__="expecting json object(6), but it is not".

What do you suggest?

Copy link
Member

@owen-d owen-d left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to support drop with __error_details__. Is there a reason you don't think so? For instance, | drop __error_details__=~"unexpected json:.*" would be helpful.

- `=~`: regex matches
- `!~`: regex does not match

The `| drop` expression will drop the given labels in the pipeline. For example, for the query `{job="varlogs"}|json|drop level, method="GET"`, with below log line
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add a few other examples:

| drop level
| drop level="warn"
| drop app=~"api.*"
| drop foo="bar", bazz

Copy link
Contributor Author

@adityacs adityacs Jan 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have added one more example with regex match. The examples shown in doc will cover the above examples. Let me know if we should add more.

@grafanabot
Copy link
Collaborator

./tools/diff_coverage.sh ../loki-target-branch/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

@adityacs
Copy link
Contributor Author

adityacs commented Jan 11, 2023

@owen-d Have added support for __error_details__ in drop

@adityacs adityacs requested a review from owen-d January 11, 2023 11:58
Copy link
Member

@owen-d owen-d left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great. I'm approving now, but I think | drop __error__ should also remove __error_details__ so we can more ergonomically use | drop __error__ instead of needing to do | drop __error__ __error_details__. Can we make that last change?

the result will be

```
{} INFO GET / loki.net 200
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is how it should work, but currently I expect it to keep __error_details__ when | drop __error__ is used. I think it should also remove __error_details__ like this doc suggests.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@owen-d Yeah, that was the earlier behaviour I added but later removed that while adding support for __error__details__. I will send a follow up PR for this change.

What should be the behaviour in this case |drop __error_details__ or |drop __error_details__="some error details"? Should we remove __error__ with this?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Personally I think |drop __error_details__ shouldn't remove __error__, but |drop __error__ should also remove __error_details__. To me, it feels like the __error_details__ are a child of __error__

@grafanabot
Copy link
Collaborator

./tools/diff_coverage.sh ../loki-target-branch/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
size/L type/docs Issues related to technical documentation; the Docs Squad uses this label across many repositories
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Querying mixed format logs Log query fallback parse method
4 participants