Log query cookbook

Labels depend on Promtail's pipeline. If a query returns nothing, open one raw line and match the real label names. These patterns match the intended pipeline.

All lines for one request:

{service="feed-service"} | json | traceId="abc123"

Errors in the last 15 minutes for one service:

{service="auth-service"} | json | outcome="failure"

Kong 5xx for a route:

{service="kong"} | json | httpStatus >= 500

A use case:

{service="expense-service"} | json | event="SettleExpenseSplitUseCase"

Outbox relay publish failures:

{service="outbox-relay-service"} | json | outcome="failure"

If Loki has no line and Prometheus shows the request, the log pipeline is the fault. Check Promtail targets before you change application code.

Do not paste a log line that contains a token into a chat or a ticket. The traceId and the route are enough.