loki-query

Query Loki logs by traceid, keywords, pod, namespace, labels, or time range to debug and analyze Kubernetes application issues via API.

Loki Log Query

Query logs from Grafana Loki using the bundled script.

Two Access Modes

1. Direct URL Access (Recommended)

Use when Loki is accessible via network (cloud service, remote server, etc.):

bash

# Using remote Loki URL
python scripts/query_loki.py \
  --loki-url "https://loki.example.com:3100" \
  --query "{namespace=\"default\"}" \
  --start "now-1h" \
  --limit 50

2. Kubernetes Port-Forward

Use when Loki is only accessible via kubectl:

bash

# Terminal 1: Port-forward Loki
kubectl port-forward -n prometheus svc/loki 3100:3100

# Terminal 2: Query logs
python scripts/query_loki.py \
  --loki-url "http://localhost:3100" \
  --query "{namespace=\"default\"}"

Or use inline port-forward with kubectl exec:

bash

kubectl exec -n prometheus <loki-pod> -- curl -s "http://localhost:3100/loki/api/v1/query_range?query={namespace=\"default\"}&limit=50"

Query Script

Use scripts/query_loki.py to query logs:

bash

python scripts/query_loki.py \
  --loki-url "http://localhost:3100" \
  --query '{namespace="default"}' \
  --start "now-1h" \
  --end "now" \
  --limit 100

Default: If --loki-url is not specified, uses http://localhost:3100.

Common Query Patterns

By Namespace

text

{namespace="<namespace>"}

By Pod

text

{namespace="<namespace>", pod="<pod-name>"}

By Labels

text

{namespace="<ns>", app="<app-label>"}

Search Keywords

text

{namespace="<ns>"} |= "ERROR"
{namespace="<ns>"} |= "traceid=<trace-id>"
{namespace="<ns>"} |= "Exception"

Time Range

• Last 1 hour: now-1h
• Last 30 minutes: now-30m
• Specific range: 2026-03-27T10:00:00Z to 2026-03-27T11:00:00Z

Parameters

• loki-url: Loki API endpoint (default: http://localhost:3100)
• query: LogQL query string (required)
• start: Start time (ISO 8601 or relative like now-1h, default: now-1h)
• end: End time (ISO 8601 or relative like now, default: now)
• limit: Max results (default: 100)
• direction: "forward" or "backward" (default: backward)
• --json: Output raw JSON instead of formatted text

Output

Returns formatted log lines. Each entry shows timestamp and log content.

Examples

Query error logs from last hour

bash

python scripts/query_loki.py --query '{namespace="production"} |= "ERROR"'

Query specific trace ID

bash

python scripts/query_loki.py --query '{namespace="default"} |= "traceid=abc123"'

Query pod logs with JSON output

bash

python scripts/query_loki.py --query '{namespace="default",pod="my-app-0"}' --json