Skip to main content

Workflow: Log Structure & Field Discovery

Reverse-engineering log schemas, field types, and recurring message templates without guessing at field keys.

Step 1: Detect Structured Fields​

Query Loki's metadata engine to identify all structured keys present in recent log entries:

get_detected_fields(query='{app="billing-service"}')

The tool returns:

  • Discovered Keys: customer_id (string), amount (float), currency (string), duration_ms (integer).
  • Inferred Cardinality: Estimated unique values per field.
  • Parser Stage Recommendation: | json.

Step 2: Extract Recurring Patterns​

For unstructured or plain-text logs, extract structural templates:

get_log_patterns(query='{app="billing-service"}')

Returns Recurring Templates:

"Processed payment of <amount> for customer <customer_id> in <duration_ms>ms"

Use the returned pattern expression in your LogQL query:

{app="billing-service"} | pattern `Processed payment of <amount> for customer <customer_id> in <duration_ms>ms` | duration_ms > 2000