Convert EventId to labels

[turowicz]

EventIds are extremely useful when searching through logs for specific events.

Currently they are being pasted as json and the label parser only interprets the first {

It would be great if EventId.Id and EventId.Name were parsed as individual labels so we can quickly search through logs using the label indexers.

cc @josephwoodward

[turowicz]

Adding it as label field pastes the full json in and it's impossible to filter logs by label using the Id or Name:

[turowicz]

Specifically I need this because I am using the .NET native logging methods with EventId overload:

https://docs.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.loggerextensions.log?view=dotnet-plat-ext-5.0#Microsoft_Extensions_Logging_LoggerExtensions_Log_Microsoft_Extensions_Logging_ILogger_Microsoft_Extensions_Logging_LogLevel_Microsoft_Extensions_Logging_EventId_System_Exception_System_String_System_Object___

[turowicz]

Alternatively you could tell me what would be the LogQL query to get the label that has Id 101, or by name RequestEnd.

[Jexs]

I would strongly recommend reading some more about Loki best practices. In your screenshot you show 2 labels consisting of a log level as well as an EventId which both seem to be highly dynamic (EventId more so than log level). Both of these are not recommended for Loki. Here is a great read for more information regarding best practices for labels: https://grafana.com/docs/loki/latest/best-practices/

As for the LogQL, to get ID 101 you can use regex in the label. So something along the lines of: {EventId=~".*Id: 101.*"}

[turowicz]

@Jexs I understand what you are saying about dynamic labels, but the EventId is already being added by this Nuget library so my suggested change would actually make it much smaller and less dynamic - by replacing the entire JSON with an integer.

[turowicz]

@Jexs no top of that, my EventIds are not dynamic, but rather static.