logql-generator_skill

Overview

This skill is a comprehensive toolkit for generating production-ready LogQL queries that follow current standards and conventions. It guides you through an interactive planning workflow, produces optimized LogQL for logs or metrics, and provides repeatable patterns for dashboards, alerts, and troubleshooting. Use it to convert requirements into accurate, performant queries for Loki.

How this skill works

The skill engages you in collaborative planning: it asks about goals, log sources, formats, and whether you want log or metric queries. It then recommends stream selectors, line filters, parsers, and aggregations, presents a plain‑English plan for confirmation, and generates final LogQL along with usage notes. For complex or performance‑critical queries it references vetted examples and best practices before producing the query.

When to use it

• Creating LogQL for dashboards, panels, or observability panels
• Designing alerting rules or recording rules based on logs
• Troubleshooting application errors, performance, or security incidents
• Converting log parsing requirements (JSON, logfmt, patterns) into queries
• Building metrics from logs (error rates, latency percentiles, topk)

Best practices

• Always narrow stream selectors with specific labels before applying heavy parsing
• Apply cheap line filters (|=, |~) before parsers; parsing is more expensive
• Prefer pattern or logfmt over json when performance matters; avoid regex when possible
• Use aggregation functions (count_over_time, rate, quantile_over_time) with appropriate time ranges
• Present a plain‑English plan and confirm before generating final queries

Example use cases

• Alerting: error rate > 5% for a service using sum(rate(...)) and vector(0) fallback
• Dashboard: 95th percentile latency using quantile_over_time on an unwrapped duration field
• Ad‑hoc troubleshooting: incremental build—test stream selector, add line filter, then parser
• Top-N reporting: topk or approx_topk for high‑volume endpoints with sum by (endpoint)
• Structured metadata: filter detected_level or trace_id after confirming Loki 3.x features