How do I install the Observability Loki skill?

Run npx skillmds@latest add incidentfox/observability-loki in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Observability Loki skill do?

Query and analyze logs from Grafana Loki using LogQL It is listed under AI & ML on SkillMD.

Is Observability Loki safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Observability Loki?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Observability Loki free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Observability Loki?

incidentfox (@incidentfox) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Observability Loki by incidentfox — Agent Skill

Name: Observability Loki
Author: incidentfox

File contents

Loki Log Analysis Skill

Query and analyze logs from Grafana Loki for incident investigation and debugging.

Investigation Workflow

List available labels to understand what's queryable
Get statistics to understand log volume and error rates
Sample logs to see representative entries
Query specific patterns with LogQL

LogQL Quick Reference

Stream Selectors (required)

{app="frontend"}                    # Exact match
{namespace=~"prod-.*"}              # Regex match
{container!="sidecar"}              # Not equal
{pod=~".+"}                         # Any non-empty value

Line Filters

{app="api"} |= "error"              # Contains "error"
{app="api"} != "debug"              # Does not contain
{app="api"} |~ "error|warn"         # Regex match
{app="api"} !~ "health|ready"       # Regex not match

Parser & Label Extraction

{app="api"} | json                  # Parse JSON logs
{app="api"} | logfmt                # Parse logfmt
{app="api"} | pattern `<ip> - <_> [<timestamp>] "<method> <path>"`
{app="api"} | json | level="error"  # Filter on extracted labels

Aggregations (Metric Queries)

# Count logs per second
rate({app="api"}[5m])

# Count errors per minute
sum(rate({app="api"} |= "error" [1m])) by (pod)

# Bytes processed
bytes_rate({app="api"}[5m])

# Unique values
count_over_time({app="api"} | json | __error__="" [1h])

Available Scripts

list_labels.py

List available labels and their values.

python scripts/list_labels.py
python scripts/list_labels.py --label app
python scripts/list_labels.py --label namespace --json

get_statistics.py

Get log volume and error statistics.

python scripts/get_statistics.py --selector '{app="frontend"}'
python scripts/get_statistics.py --selector '{namespace="production"}' --lookback 2
python scripts/get_statistics.py --selector '{app=~"api.*"}' --json

sample_logs.py

Get sample log entries.

python scripts/sample_logs.py --selector '{app="frontend"}'
python scripts/sample_logs.py --selector '{app="api"}' --filter "error"
python scripts/sample_logs.py --selector '{namespace="prod"}' --limit 50 --json

query_logs.py

Execute raw LogQL queries.

python scripts/query_logs.py '{app="api"} |= "error" | json'
python scripts/query_logs.py 'rate({app="api"} |= "error" [5m])' --type metric
python scripts/query_logs.py '{app="api"}' --limit 100 --lookback 2 --json

Environment Variables

LOKI_BASE_URL: Proxy endpoint (production)
LOKI_URL: Direct Loki URL (testing, e.g., http://loki:3100)

Common Investigation Patterns

Find errors in a service

python scripts/sample_logs.py --selector '{app="api"}' --filter "error|exception|fail"

Compare error rates across pods

python scripts/query_logs.py 'sum(rate({app="api"} |= "error" [5m])) by (pod)' --type metric

Find slow requests (if using JSON logs with duration)

python scripts/query_logs.py '{app="api"} | json | duration > 1000' --limit 20

Correlate logs around a timestamp

python scripts/query_logs.py '{app="api"}' --start "2024-01-15T10:30:00Z" --end "2024-01-15T10:35:00Z"

---name: observability-lokidescription: Query and analyze logs from Grafana Loki using LogQL---# Loki Log Analysis SkillQuery and analyze logs from Grafana Loki for incident investigation and debugging.## Investigation Workflow1. **List available labels** to understand what's queryable2. **Get statistics** to understand log volume and error rates3. **Sample logs** to see representative entries4. **Query specific patterns** with LogQL## LogQL Quick Reference### Stream Selectors (required)```logql{app="frontend"} # Exact match{namespace=~"prod-.*"} # Regex match{container!="sidecar"} # Not equal{pod=~".+"} # Any non-empty value```### Line Filters```logql{app="api"} |= "error" # Contains "error"{app="api"} != "debug" # Does not contain{app="api"} |~ "error|warn" # Regex match{app="api"} !~ "health|ready" # Regex not match```### Parser & Label Extraction```logql{app="api"} | json # Parse JSON logs{app="api"} | logfmt # Parse logfmt{app="api"} | pattern `<ip> - <_> [<timestamp>] "<method> <path>"`{app="api"} | json | level="error" # Filter on extracted labels```### Aggregations (Metric Queries)```logql# Count logs per secondrate({app="api"}[5m])# Count errors per minutesum(rate({app="api"} |= "error" [1m])) by (pod)# Bytes processedbytes_rate({app="api"}[5m])# Unique valuescount_over_time({app="api"} | json | __error__="" [1h])```## Available Scripts### list_labels.pyList available labels and their values.```bashpython scripts/list_labels.pypython scripts/list_labels.py --label apppython scripts/list_labels.py --label namespace --json```### get_statistics.pyGet log volume and error statistics.```bashpython scripts/get_statistics.py --selector '{app="frontend"}'python scripts/get_statistics.py --selector '{namespace="production"}' --lookback 2python scripts/get_statistics.py --selector '{app=~"api.*"}' --json```### sample_logs.pyGet sample log entries.```bashpython scripts/sample_logs.py --selector '{app="frontend"}'python scripts/sample_logs.py --selector '{app="api"}' --filter "error"python scripts/sample_logs.py --selector '{namespace="prod"}' --limit 50 --json```### query_logs.pyExecute raw LogQL queries.```bashpython scripts/query_logs.py '{app="api"} |= "error" | json'python scripts/query_logs.py 'rate({app="api"} |= "error" [5m])' --type metricpython scripts/query_logs.py '{app="api"}' --limit 100 --lookback 2 --json```## Environment Variables- `LOKI_BASE_URL`: Proxy endpoint (production)- `LOKI_URL`: Direct Loki URL (testing, e.g., http://loki:3100)## Common Investigation Patterns### Find errors in a service```bashpython scripts/sample_logs.py --selector '{app="api"}' --filter "error|exception|fail"```### Compare error rates across pods```bashpython scripts/query_logs.py 'sum(rate({app="api"} |= "error" [5m])) by (pod)' --type metric```### Find slow requests (if using JSON logs with duration)```bashpython scripts/query_logs.py '{app="api"} | json | duration > 1000' --limit 20```### Correlate logs around a timestamp```bashpython scripts/query_logs.py '{app="api"}' --start "2024-01-15T10:30:00Z" --end "2024-01-15T10:35:00Z"```

Frequently asked questions

Observability Loki