Grafana Loki LogQL Stream Selector Filter Misses Logs Fix

In this tutorial, you'll learn about Grafana Loki LogQL Stream Selector Filter Misses Logs Fix. We cover key concepts, practical examples, and best practices.

Your Grafana Loki LogQL query returns zero results — the stream selector uses incorrect label matchers, the label values are wrong, or no logs match the time range. Stream selectors must match exactly one or more streams for the query to return data.

The Problem

{job="myapp"} |= "error"

(no results returned)

The stream selector {job="myapp"} matches a label value that does not exist in Loki. The job label might be myapp-prod or myapp-web, but the query uses the wrong value.

Step-by-Step Fix

1. Discover available labels

// Find all label names
label_names()

// Find values for a specific label
label_values(job)

// Expected output:
// job: myapp-web, myapp-api, myapp-worker

2. Use correct label matchers

// Match exact label value
{job="myapp-web"}

// Match multiple values with regex
{job=~"myapp-.*"}

// Exclude a specific value
{job!="myapp-worker"}

3. Combine stream and line filtering

// Stream selector first, then line filter
{job="myapp-web", env="production"} |= "error"

// Multiple line filters
{app="nginx"} |= "500" != "health"

// Pipeline expressions
{job="myapp-api"} | json | level = "error"

4. Filter by time range explicitly

{job="myapp-web"} |= "error"

// Query with explicit time range in Grafana dashboard
// Set time range to last 1h or last 24h

5. Check for label cardinality issues

// High-cardinality labels like request_id cause slow queries
// Avoid: {request_id="abc-123"}
// Use: {job="myapp-web", method="GET"} |= "abc-123"

// Check label cardinality with Grafana Loki label explorer
label_values(request_id)

Expected output:

{job="myapp-web"} |= "error"
→ 42 results in last 1h
  level=error msg="connection refused" service=users port=5432
  level=error msg="timeout" service=orders duration=30s

Prevention Tips

• Use label_names() and label_values() to discover available labels
• Use {app~="prefix-.*"} regex matchers for broad matching
• Avoid high-cardinality labels in stream selectors — use line filters instead
• Set reasonable time ranges to limit log volume
• Use env, job, and app labels for primary stream selection

Common Mistakes with loki query

1. Forgetting deriving (Show, Eq) on custom data types needed for debugging
2. Placing the wildcard pattern first in case expressions, making all subsequent patterns unreachable
3. Using head and tail instead of pattern matching, causing runtime errors on empty lists

These mistakes appear frequently in real-world GRAFANA code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ