Get original entry value in LogQL line_format

Question

In LogQL line_format template expression, is there a way to access the original log entry (assume the entry is not in JSON or any parseable format and all labels are log labels and not extracted labels).

example: ... | line_format "{{.log_label1}}, {{.log_label2}}: {{<some way to show the entire original log entry>}}"

Lille

Answer 1

One way it to prepend it with a regular expression capturing the entire message

... |regexp '(?P<message>.*)' |line_format "{{.some_other_var}} {{.message}}"

Note that the ' around the regex should really by ` otherwise it might not work

Besse

The regexp is a nice trick, thanks! I wonder if there is some "default" variable that would allow the same without involving another parser... – Lille

Yup, I was wondering that too and then found your question :) sadly the documentation is not really that good , though it is a great product – Besse

Answer 2

You can use the line template function:

... | line_format "{{.host}} {{ __line__ }}"

Editorial

Answer 3

It looks like instead of regexp you can use json parser:

... | json | line_format "{{.stream}}: {{.log}}"

Batho