Skip to content

Add LogQL 101 tutorial#57

Open
nicolevanderhoeven wants to merge 28 commits intomainfrom
nvdh/logql101
Open

Add LogQL 101 tutorial#57
nicolevanderhoeven wants to merge 28 commits intomainfrom
nvdh/logql101

Conversation

@nicolevanderhoeven
Copy link
Contributor

@nicolevanderhoeven nicolevanderhoeven commented Jan 7, 2026

LogQL 101 Tutorial

Beginner-friendly, step-by-step guide for writing LogQL queries in Grafana Explore.

Note for testing: This tutorial requires a data source on Grafana Play. You'll need to be on this page to start, and I've added an initial (skippable) navigational step to ensure this.

Topics covered

  • Selecting a Loki data source
  • Setting the time range
  • Label selectors
  • Line filters (|=, !=)
  • JSON parsing (| json)
  • Line formatting (| line_format)
  • Regex matching (|~)
  • Metrics from logs (count_over_time, rate, sum by)
  • Creating a graph from the metrics

- Add Step 1: Select data source (split multistep into separate blocks)
- Add Step 2: Time range picker with interactive steps
- Add Step 3: First LogQL query with label selectors and filters
- Add Step 4: JSON parsing for precise filtering (using multistep for focus+fill)
- Add Step 5: Line formatting with line_format
- Add Step 6: Regex matching (framed as last resort)
- Add Step 7: Metrics teaser (count_over_time, rate, sum by)
- Add Step 8: Wrap-up summary

Fixes:
- Remove section-completed gates that weren't working reliably
- Use multistep in Step 4 to fix Monaco editor append issue
- Fix time picker selector to use #TimePickerContent label:contains()
- Sync unstyled.html with content.json
…ection

The data source picker dropdown closes between separate 'Do It' clicks,
causing the second step to fail. Using multistep ensures both actions
(open picker + select data source) happen in quick succession.
- Convert formfill to multistep with hidden highlight step to fix Monaco
  editor append issue
- Update line_format to show both status and request_uri:
  | line_format "{{.status}} {{.request_uri}}"
- Change regex query to find HTTP 500 errors on URIs with numeric IDs:
  | json | status = "500" |~ "id/[0-9]+/"
- Convert to multistep to fix Monaco editor append issue
- Shows combining JSON parsing with regex for real-world use case
- Fix regex field filter to use .* anchors (=~ requires full match)
- Update example URI to match actual data (/id/480195034)
- Step 6: Explain difference between |~ line filters and =~ field filters
- Step 7: Turn cardinality error into teaching moment
  - First show count_over_time without sum (triggers error)
  - Explain why JSON parsing creates many series
  - Then show fix with sum(count_over_time(...))
- Remove rate-by-host query (only one host in dataset)
- Use 1h window for better visualization of sparse data
- Add explanatory text after query step explaining label selector syntax
- Add step to click first log line and expand details
- Add highlights for Log line, Indexed labels, and Structured metadata sections
- Use stable selectors for virtualized log rows (top: 0px positioning)
- Update Run query and results area step content
…teps

Multisteps with requirements and reftarget at the block level cause
'Do Section' to fail silently. Removed these properties while keeping
tooltips, matching the pattern used in other working tutorials
(first-dashboard, alerting-101, rca-demo).
- Add step to click log line and view details
- Add step to highlight Parsed field section
- Add explanation of parsed fields and JSON auto-parsing
- Add teaser for next section about formatting output
- Split multisteps into separate interactive blocks (matching Section 1 pattern)
…ration

- Move intro paragraph to after section heading for better flow
- Add step to click first log line and view parsed fields
- Add step to highlight Parsed fields section with educational tooltip
- Add formfill step to include request_method in line_format query
- Add explanation about viewing only relevant info while retaining access to full logs
- Use specific Monaco selector for better formfill behavior
- Rename section from 'Use regex carefully' to 'Use regex for complex patterns'
- Add intro explanation for when regex is useful
- Update query to build on Section 4 (include request_method in line_format)
- Add step to match all 5xx status codes with status =~ "5.."
- Move tip and performance note outside section block
- Clarify tip about !~ exclude operator
- Change time range in Section 1 to 'Last 7 days' for more log data
- Added Query best practices link to wrap-up section
- Added parser expressions and JSON parser links to JSON section
- Added regexp parser expression link to regex section
- Updated sections to explain that json and regexp are parser expressions
@Jayclifford345
Copy link
Collaborator

aaah i think i know what might be happening. It may be due to the fact tooltip is being used at the multistep container level

 "type": "multistep",
          "tooltip": "Select the data source used by this guide.",
          "content": "Select **LokiNGINXLogs** in the Data source menu. This datasource contains logs from an Nginx web server and we'll be using it for the rest of this tutorial.",

rather than being used at the step level for example:

 {
          "type": "multistep",
          "content": "Use the **Add** button to send your queries to a new dashboard.",
          "requirements": ["section-completed:section-explore-tutorial"],
          "steps": [
            {
              "action": "highlight",
              "reftarget": "button[aria-label=\"Add\"]",
              "requirements": ["exists-reftarget"]
            },
            {
              "action": "highlight",
              "reftarget": "button:contains(\"Add to dashboard\")",
              "requirements": ["exists-reftarget"]
            },
            {
              "action": "highlight",
              "reftarget": "button:contains(\"Open dashboard\")",
              "requirements": ["exists-reftarget"],
              "tooltip": "One of Grafana's best features is the seamless transition from Explore to dashboards. Instead of manually recreating your queries, you can send them directly from Explore to a new or existing dashboard. This workflow saves time and ensures your carefully crafted queries make it to your dashboard exactly as you tested them."
            }
          ]
        },

i think that might be somthing we need to clear up in block editor and happy to review the rest

Moved all 16 tooltips in the LogQL 101 tutorial from the multistep
block container level to the first step within each multistep block.
This follows the correct pattern where tooltips should be defined at
the individual step level for proper display.
Copy link
Collaborator

@moxious moxious left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See individual comments, two over-arching things:

  • Consider the use of skippable: true on steps that are complex or are side-quests. Never use skippable: true if taking one step sets you up for the next
  • You can actually drop the HTML version from your PR entirely. The HTML is now the legacy format, so the overall tutorial will be cleaner if it's JSON only and it's less for you to keep in sync. There are some discrepencies between your JSON and HTML, but they're not worth fixing, since if you have JSON, the actual plugin will never look at your HTML.

Mark 5 highlight-only steps as skippable: view results area,
log line section, indexed labels, structured metadata, and
parsed fields (Section 4). These are educational highlights
that users can skip if already familiar with the UI.
The Interactive Tutorials plugin reads from content.json, not the HTML file.
The HTML was only needed as a URL entry point but its content was ignored.
PR reviewer couldn't proceed because they weren't on the right page.
Added a skippable step at the start of Section 1 to click Explore
in the sidebar, with navmenu-open and exists-reftarget requirements.
Steps for viewing results and expanding log lines should not be
skippable since subsequent steps depend on the expanded log view.
Moved the paragraph about log details panel and result volume
to appear after the section closes, just before "What you have
learned" summary.
Update all query editor selectors from textarea.inputarea to
textarea.inputarea.monaco-mouse-cursor-text so the guide engine
properly detects Monaco editors and replaces content instead of
inserting at cursor position.
Per reviewer feedback:
- Convert highlight+formfill patterns to just formfill (the highlight
  before a formfill doesn't add value and makes the guide feel slow)
- Convert single-step multisteps to regular interactive blocks
- Move tooltips to the formfill action where applicable

This reduces complexity and improves guide execution speed.
@nicolevanderhoeven nicolevanderhoeven changed the title Draft: Add LogQL 101 tutorial Add LogQL 101 tutorial Jan 27, 2026
@moxious
Copy link
Collaborator

moxious commented Jan 27, 2026

NOTE: Flag as cloud only (not OSS) -- in part because controls in Explore are different 🫤

Doesn't impact much though bc this targets Play, which is cloud

@moxious
Copy link
Collaborator

moxious commented Jan 27, 2026

Cross-linking necessary product fix for guide: grafana/grafana-pathfinder-app#496

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Comments