what is the substitute of splunk eval in logql?

Question

I have this expression in my splunk query eval A = A + '/' + B where A is the new variable (column name) to which I am assigning the values of A and B from my log line and I need to replace the same expression in loki grafana using logql. Right now I am just getting two columns Time and {}. I want to replaace TIme column with eval expression. Can someone please help me on this ?

Answer 1

The equivalent of variables in LogQL are labels.

Thus, you can use label_format to achieve what you want.

Here is an example of how to use label_format to perform a string concatenation of two labels, named var_a and var_b:

Input:

{"var_a": "a", "var_b": "b", "message": "hello there!"}

LogQL query:

{service="my-awesome-app"}
  | json # or logfmt, depending on your log format
  | label_format var_a=`{{.var_a}}/{{.var_b}}` # this reassigns var_a based on the given template

Output:

{"var_a": "a/b", "var_b": "b", "message": "hello there!"}