loki alert silence some labels

[lddlww]

when used loki for alert，people my want to known what message result the alert， i used loki metric query like

sum by (host_ip,level,message,type) (count_over_time(({level=~"error|crit|emerg|warning|err"} |~ "NIC"|~"down" |json message="message")[5m]))>=1

but this query will generate many alerts in one time，because the label of message is difference ; instead it using

sum by (host_ip,level,type) (count_over_time(({level=~"error|crit|emerg|warning|err"} |~ "NIC"|~"down" |json message="message")[5m]))>=1

, which generate one alert in one time，this could be better， but people could not found more detail，as message missing

how can i do to solve above problem？

best wishes

[UlricQin]

The second approach is better. Once the engineer receives the alert, they can then query for detailed information. Displaying log details within the alert event is not a best practice.