Practise Grafana Loki's core vocabulary — log streams and label cardinality, LogQL filter vs metric queries, structured metadata, and Promtail pipeline stages for log enrichment.
0 / 5 completed
1 / 5
In Grafana Loki, what is a log stream?
A log stream in Loki is defined by a unique set of labels (e.g., {app="nginx", env="prod"}). All log entries sharing the same label set belong to the same stream. Loki indexes only labels, not log content, so stream cardinality directly affects resource usage.
2 / 5
What does a label selector like {app="api", env="prod"} do in a LogQL query?
Label selectors are the first part of every LogQL query and operate on the stream index. {app="api", env="prod"} retrieves all streams where both labels match exactly. Operator variants include =~ (regex match), != (not equal), and !~ (regex not match).
3 / 5
What is the difference between a filter expression and a metric expression in LogQL?
LogQL has two query types. Filter/log queries return raw log lines filtered by patterns (|= "error", | json) and are used in log panels. Metric queries wrap a log query in functions like rate() or count_over_time() to produce time-series data for graphs and alerts.
4 / 5
What is structured metadata in Loki and how does it differ from labels?
Structured metadata (introduced in Loki 3.x) allows attaching arbitrary key-value pairs to individual log entries without creating new label combinations. Unlike labels, they do not affect stream cardinality, making them suitable for high-cardinality data like trace IDs or request IDs that would explode the index if used as labels.
5 / 5
What do pipeline stages in a Promtail/Loki agent configuration do?
Pipeline stages in Promtail's scrape config form a processing pipeline. Common stages include regex (extract fields), json (parse JSON), labels (promote fields to labels), timestamp (override log time), and drop (filter unwanted lines). They transform raw log lines into enriched, properly labelled streams.