pySigma-backend-loki

pySigma-backend-loki copied to clipboard

When correlating multiple queries, we can do so using Loki and LogQL by generating one metric query per log query, and combining them with OR (for event_count and value_count correlation rules) or AND (for temporal correlation rules). E.g., the following log queries:

{job=`.+`} | logfmt | fieldA=`valueA`
{job=`.+`} | json | fieldB=`valueB`

can be converted into an event_count correlation query with greater than or equal to 2 events with the following LogQL:

(sum(count_over_time({job=`jobA`} | logfmt | fieldA=`valueA`[$__auto])) 
    or sum(count_over_time({job=`jobB`} | json | fieldB=`valueB`[$__auto]))) >= 2