Loki Metrics Reference ¶
This reference document describes the metrics that are automatically derived from logs collected by Loki in the NAIS platform.
loki:service:loglevel:count1m
This metric represents the count of logs aggregated over a 1-minute window, categorized by service and log level.
Description ¶
The loki:service:loglevel:count1m metric provides a pre-aggregated count of log entries for each 1-minute interval, grouped by service, namespace, cluster, and log level. This metric is particularly useful for:
- Monitoring the volume of logs at different severity levels
- Setting up alerts for unusual increases in error or warning logs
- Creating dashboards to visualize logging patterns across services
- Identifying services with excessive logging
Labels ¶
| Label | Description | Example Values |
|---|---|---|
service_name | The name of the service or application that generated the logs | my-app, user-api |
service_namespace | The Kubernetes namespace where the service is running | team-a, default |
k8s_cluster_name | The name of the Kubernetes cluster | dev-gcp, prod-gcp |
detected_level | The log level or severity of the log entries | error, warn, info, debug, trace |
Usage Examples ¶
Prometheus Query Examples ¶
Count of error logs for a specific service in the last hour:
promql
sum_over_time(loki:service:loglevel:count1m{service_name="my-app", service_namespace="my-team", detected_level="error"}[60m:1m])Ratio of errors to total logs for all services in a namespace:
promql
sum(loki:service:loglevel:count1m{service_namespace="my-team", detected_level="error"}) /
sum(loki:service:loglevel:count1m{service_namespace="my-team"})Alert Examples ¶
Alert on high number of error logs:
promql
sum(loki:service:loglevel:count1m{detected_level="error"}) > 100Best Practices ¶
- Do not use
increase()orrate()functions with this metric, as it is already pre-aggregated for 1-minute intervals - For longer time ranges, wrap the metric in
sum_over_time(...[60m:1m])to add up the pre-aggregated counts over the window; a bare subquery like[60m:1m]returns a range vector and cannot be passed directly tosum() - Consider setting appropriate thresholds for alerts based on your application's normal logging behavior
- Combine with other metrics (like HTTP status codes) for more comprehensive service health monitoring