Loki Troubleshoot

---
name: loki-troubleshoot
description: "Help craft efficient Grafana Loki / LogQL queries for debugging logs — with label‑based filtering, narrow time windows, and best‑practice guidance to avoid expensive or overly broad scans."
---

# Loki Troubleshooting & Query‑Builder Skill

## What this Skill does

When a user asks you (Claude) for help inspecting logs via Loki — e.g. “find errors in service X”, “search for request_id=abc123”, “show me 500 responses between 2‑3 PM last night” — use this skill to:

- Ask clarifying questions if needed (e.g. which service / label context, approx time window, any known label names).  
- Build a recommended LogQL query that:  
  - uses **low‑cardinality labels** (service, env, host, etc.) whenever possible  
  - confines to a **narrow time window** (minutes — hours, not days) by default  
  - uses **fast filters** (`|=` or `|!=`) rather than regex or heavy parsing  
  - performs JSON/structured parsing only *after* filtering  
- Provide human-readable explanations and **warnings** for expensive queries  
- Suggest alternative strategies (metrics, recording rules, structured logs)

## Best Practices

- Prefer stable labels (`app`, `env`, `namespace`, `cluster`, etc.)  
- Avoid high-cardinality labels (`user_id`, `request_id`, UUIDs)  
- Always restrict the **time window**  
- Use `|=` before regex or parsing  
- Provide warnings for:  
  - No label selector  
  - Very wide time windows  
  - JSON parse without pre-filter  
  - Regex-heavy queries  

## Example Queries

| User Request                                                                                     | Resulting LogQL                                  |
|--------------------------------------------------------------------------------------------------|--------------------------------------------------|
| "Show me all 500 errors in the `orders` service in the last 2 hours."                            | `{app="orders", env="prod"}[2h] \|= "500"`        |
| "Find logs for request_id `abc123` in staging for `payments` service over past 30 minutes."      | `{app="payments", env="staging"}[30m] \|= "abc123"` |

## Limitations

- This skill does not execute queries