In Loki when doing {app="foo"} | json | duration > 2 we actually first extract all labels, then filter. It would be faster that as we extract labels we apply filtering before pushing extracted data as label.
This isn't going to be easy because:
there could be multiple parser that overrides label value
there could be or and and clause of label filter.
Labels can be mutated in between by a label_format stage {app="foo"} | json | label_format duration="..." | duration > 2
This could allow to avoid allocations, as we can test on []byte instead of string.
In Loki when doing
{app="foo"} | json | duration > 2
we actually first extract all labels, then filter. It would be faster that as we extract labels we apply filtering before pushing extracted data as label.This isn't going to be easy because:
or
andand
clause of label filter.label_format
stage{app="foo"} | json | label_format duration="..." | duration > 2
This could allow to avoid allocations, as we can test on []byte instead of string.