grafana / loki

Like Prometheus, but for logs.
https://grafana.com/loki
GNU Affero General Public License v3.0
24.05k stars 3.47k forks source link

Loki Ingesting Malformed Logs #13926

Open tim-shane opened 3 months ago

tim-shane commented 3 months ago

Describe the bug Grafana Cloud Logs is ingesting logs with a - in the label name, resulting in an error when you try to search the logs. In GC, when using Explore Logs, for example, there is a count of logs, but they aren't searchable due to the invalid character in the log labels.

To Reproduce Steps to reproduce the behavior:

  1. Ingest logs with a hyphen in the label name
  2. Try to query that data
  3. Error: failed to parse series labels to categorize labels: 1:622: parse error: unexpected character inside braces: '-'

Expected behavior I would expect for Loki to reject malformed log entries and not ingest.

Environment:

Screenshots, Promtail config, or terminal output failed to parse series labels to categorize labels: 1:622: parse error: unexpected character inside braces: '-'

ravishankar15 commented 3 days ago

@tim-shane I can see that this is no longer happening in OSS loki main branch. Hope fully updating your loki should solve the issue.

For reference,

curl --location 'http://localhost:3100/loki/api/v1/push' \ --header 'Content-Type: application/json' \ --data '{ "streams": [ { "stream": { "service_name": "stream001", "help-tag": "help001" }, "values": [ [ "1732615200000000000", "{\"timestamp\":\"2022-12-23T12:34:56Z\",\"level\":\"warning\",\"message\":\"ts=2024-03-30T23:03:40 caller=grpc_logging.go:66 level=info method=/cortex.Ingester/Push duration=200ms msg=gRPC\",\"free_memory\":456,\"total_memory\":1024}" ], [ "1732617000000000000", "{\"timestamp\":\"2022-12-23T12:34:56Z\",\"level\":\"warning\",\"message\":\"ts=2024-03-30T23:03:41 caller=grpc_logging.go:66 level=info method=/cortex.Ingester/Push duration=500ms msg=gRPC\",\"free_memory\":456,\"total_memory\":1024}" ] ] } ] }'

the label contains - and it does not get ingested and throws error.