Loki Log Query#

Query logs from Grafana Loki using the bundled script.

Two Access Modes#

1. Direct URL Access (Recommended)#

Use when Loki is accessible via network (cloud service, remote server, etc.):

bash

# Using remote Loki URL
python scripts/query_loki.py \
  --loki-url "https://loki.example.com:3100" \
  --query "{namespace=\"default\"}" \
  --start "now-1h" \
  --limit 50

2. Kubernetes Port-Forward#

Use when Loki is only accessible via kubectl:

bash

# Terminal 1: Port-forward Loki
kubectl port-forward -n prometheus svc/loki 3100:3100

# Terminal 2: Query logs
python scripts/query_loki.py \
  --loki-url "http://localhost:3100" \
  --query "{namespace=\"default\"}"

Or use inline port-forward with kubectl exec:

bash

kubectl exec -n prometheus <loki-pod> -- curl -s "http://localhost:3100/loki/api/v1/query_range?query={namespace=\"default\"}&limit=50"

Query Script#

Use scripts/query_loki.py to query logs:

bash

python scripts/query_loki.py \
  --loki-url "http://localhost:3100" \
  --query '{namespace="default"}' \
  --start "now-1h" \
  --end "now" \
  --limit 100

Default: If --loki-url is not specified, uses http://localhost:3100.

Common Query Patterns#

By Namespace#

text

{namespace="<namespace>"}

By Pod#

text

{namespace="<namespace>", pod="<pod-name>"}

By Labels#

text

{namespace="<ns>", app="<app-label>"}

Search Keywords#

text

{namespace="<ns>"} |= "ERROR"
{namespace="<ns>"} |= "traceid=<trace-id>"
{namespace="<ns>"} |= "Exception"

Time Range#

• Last 1 hour: now-1h
• Last 30 minutes: now-30m
• Specific range: 2026-03-27T10:00:00Z to 2026-03-27T11:00:00Z

Parameters#

• loki-url: Loki API endpoint (default: http://localhost:3100)
• query: LogQL query string (required)
• start: Start time (ISO 8601 or relative like now-1h, default: now-1h)
• end: End time (ISO 8601 or relative like now, default: now)
• limit: Max results (default: 100)
• direction: "forward" or "backward" (default: backward)
• --json: Output raw JSON instead of formatted text

Output#

Returns formatted log lines. Each entry shows timestamp and log content.

Examples#

Query error logs from last hour#

bash

python scripts/query_loki.py --query '{namespace="production"} |= "ERROR"'

Query specific trace ID#

bash

python scripts/query_loki.py --query '{namespace="default"} |= "traceid=abc123"'

Query pod logs with JSON output#

bash

python scripts/query_loki.py --query '{namespace="default",pod="my-app-0"}' --json