#post

@grafana-logs-pod

I expected this to work but it doesn’t:

{cluster="a", namespace="b", app="c", pod="d"}

How does one get the logs for a particular pod?

What I tried next:

Start with the whole app (logs from all pods):

{cluster="a", namespace="b", app="c"}

Lots of logs. Some of which include include "pod_name": "dash-phenoapp-v2-67778ffc9f-wkmvh".

Tried this next (pod -> pod_name):

{cluster="a", namespace="b", app="c", pod_name="d"}

Still no logs.

But this works:

{cluster="a", namespace="b", app="c"} | json | pod_name="d"

And these work (and highlights the matching pod name text):

{cluster="a", namespace="b", app="c"} | json |= "d"

{cluster="a", namespace="b", app="c"} |= "d"

So, takeaways:

A pod’s name is labeled pod_name (not pod)
It’s part of the JSON output, so you filter for it in the log pipeline that follows the log stream selector in {} instead of including it in the log stream selector next to labels like cluster, namespace, etc
available labels will autocomplete inside the {}
String matches are crude, but effective! Don’t be too proud to try them

Add link to official Grafana Loki/Kubernetes reference material for how to query logs for various K8s resources?

Inbox