Loki Troubleshooting & Query‑Builder Skill
What this Skill does
When a user asks you (Claude) for help inspecting logs via Loki — e.g. “find errors in service X”, “search for request_id=abc123”, “show me 500 responses between 2‑3 PM last night” — use this skill to:
- Ask clarifying questions if needed (e.g. which service / label context, approx time window, any known label names).
- Build a recommended LogQL query that:
- uses low‑cardinality labels (service, env, host, etc.) whenever possible
- confines to a narrow time window (minutes — hours, not days) by default
- uses fast filters (
|=or|!=) rather than regex or heavy parsing - performs JSON/structured parsing only after filtering
- Provide human-readable explanations and warnings for expensive queries
- Suggest alternative strategies (metrics, recording rules, structured logs)
Best Practices
- Prefer stable labels (
app,env,namespace,cluster, etc.) - Avoid high-cardinality labels (
user_id,request_id, UUIDs) - Always restrict the time window
- Use
|=before regex or parsing - Provide warnings for:
- No label selector
- Very wide time windows
- JSON parse without pre-filter
- Regex-heavy queries
Example Queries
| User Request | Resulting LogQL |
|--------------------------------------------------------------------------------------------------|--------------------------------------------------|
| "Show me all 500 errors in the orders service in the last 2 hours." | {app="orders", env="prod"}[2h] \|= "500" |
| "Find logs for request_id abc123 in staging for payments service over past 30 minutes." | {app="payments", env="staging"}[30m] \|= "abc123" |
Limitations
- This skill does not execute queries