Run a LogQL range query against Loki.

query: LogQL expression, e.g. {container="nginx"} |= "ERROR" or a metric query like rate({container="traefik"}[5m]). start: Duration back from now (15m, 2h, 3d), RFC3339 timestamp, or ns-since-epoch. Default 1h. end: Same format as start. Default now. limit: Max log lines to return (clamped to server max, default 100). direction: backward (newest first) or forward. Default backward.

Returns compact timestamp [labels] message lines, newest first. For metric queries returns {labels} ts:val ts:val ... per series.

Run a LogQL instant query at a single point in time.

Best for metric queries like count_over_time({container="crowdsec"}[5m]). For raw log search, prefer loki_query_range.

Tail the most recent log lines for a single container.

container: Container name (e.g. nginx, traefik, arr-sonarr). Exact names work best; an unknown name is resolved against live container names (service vocabulary like vpn works) — a unique match is tailed automatically and flagged in the output, otherwise candidate names are returned. minutes: How far back to look. Default 15. limit: Max lines to return. Default 200. filter: Optional substring filter applied as LogQL |= "filter". Case-sensitive. Leave empty for no filter.

List all label names Loki has seen in the given lookback window.

lookback: Duration (1h, 24h, 7d). Default 1h. Shorter is faster.

List all values seen for a given label in the lookback window.

label: Label name (e.g. container, service_name, job, host). lookback: Duration (1h, 24h, 7d). Default 1h.

Mine a container's recent logs into recurring patterns — the fastest way to summarize what a noisy service is saying. One call turns thousands of lines into a ranked list of templates (<_> marks the variable parts) with occurrence counts.

container: exact container name (use loki_list_containers / loki_tail_container to find it). minutes: how far back to mine. Default 60.

Requires the Loki pattern ingester; only logs ingested after it was enabled are mined, so a small window right after enablement is normal.

Rank containers by log volume (bytes) — "which service suddenly got noisy". Leave container empty to rank the whole fleet; set it to scope to one container.

minutes: window to measure. Default 60. limit: max rows. Default 10.

Discover the fields Loki can auto-extract from a container's logs (name, type, cardinality, parser — e.g. logfmt/json). Use this before writing a LogQL parse stage in loki_query_range, e.g. finding that a service logs logfmt with a status field enables {container="x"} | logfmt | status>=500.

container: exact container name. minutes: window to sample. Default 60. limit: max fields. Default 20.

List durable container names actively logging in the lookback window.

Hides ephemeral noise — podman auto-names (adoring_neumann) and hex-suffixed batch workers (transcode-ffmpeg-<hash>) number in the thousands over 24h and would swamp the response. They remain queryable via loki_query_range; use loki_list_label_values('container') for the raw unfiltered list.

lookback: Duration (1h, 24h, 7d). Default 1h.