Quiz: Loki

← Back to quiz index

3 questions

L1 (1 questions)

1. What are LogQL pipeline stages and how do they work?

Show answer

LogQL has two phases: log stream selector ({job="app"}) and pipeline. Pipeline stages:
1. Line filters: |= (contains), != (not contains), |~ (regex match).
2. Parser: | json, | logfmt, | regexp to extract labels from log lines.
3. Label filter: | status >=
400.
4. Formatting: | line_format, | label_format. Stages execute left to right. Example: {job="app"} |= "error" | json | status >= 500 | line_format "{{.message}}".

L2 (2 questions)

1. Logs stopped appearing in Grafana/Loki. Where do you look?

Show answer

1. Check Promtail/agent pods are running.
2. Verify Promtail config (pipeline stages, scrape targets).
3. Check Loki ingestion (loki_ingester_chunks_stored_total).
4. Check label cardinality (too many = rejection).

2. How does Loki handle high-cardinality labels differently from Prometheus?

Show answer

Loki indexes only labels (not log content), so high-cardinality labels create many small index entries and chunks, degrading query performance. Loki rejects streams exceeding max_streams_per_user. Unlike Prometheus, Loki can grep through unindexed content at query time using pipeline filters. Best practice: keep label cardinality low (job, namespace, pod) and use |= or | json for high-cardinality fields in the log line itself.