LogQL — Query Language

LogQL (Loki) is PromQL-inspired:

{service="api",level="error"}                        # stream selector
{service="api"} |= "timeout"                         # filter for substring
{service="api"} |~ "user_id=\d+"                     # regex
{service="api"} != "healthcheck"                     # exclude
{service="api"} | json                               # parse JSON, extract fields
{service="api"} | logfmt | duration > 1s             # parse + filter

# Metric queries (aggregates):
sum by (service) (rate({level="error"}[5m]))         # error rate per service
count_over_time({service="api"}[1h])                 # log count last hour

Building blocks:

1. Stream selector: {label=value,...} — filters streams by label.
2. Line filters: |= substring, |~ regex match, != not contains, !~ not regex match.
3. Parsers: | json, | logfmt, | pattern — extract structured fields.
4. Label filters: | level="error" — filter on extracted fields.
5. Aggregations: count_over_time, rate, sum by, etc.

Parsing pipeline:

chunks -> filter by label selector -> stream of entries
       -> filter by line filters
       -> extract fields (parser)
       -> filter by extracted fields
       -> aggregate (if metric query)

Each filter step happens lazily — we can stop early when LIMIT is hit.

Implementation tip: break query into pipeline stages, each a generator. Compose them.