Difference between Raw logs and Range

[Heyzi]

victorialogs-datasource: v0.13.2 victorialogs: v1.4.0 I want to plot the number of errors at each point in time, but I get strange results in the Raw logs and Range. If this is correct behavior, where is the difference described? What query should I write to make the graph look more like the Raw logs graph?

[tiny-pangolin]

You can make the timeseries panel more like the logs volume panel, changing the graph style to bar under Graph styles when you are editing the panel I believe the logs volume panel in explore doesn't use a normal panel that, and it is not exposed to the user for making their own panels.

[leshcat]

Have similar question, how do you use time range/instant types? Are there any examples or documentation related to actual usage of those handlers?

I am currently trying to convert Loki PromQL: sum(count_over_time({env="dev", container="myapp"} |= '[ERROR]' [1h])) by (env, container)

which gives following graph:

to a VLogs query and get similar graph.

VLogs query i came up is: _time:1h {container="myapp", env="dev"} "[ERROR]" | stats count()

but it only works correctly on Instant type and only as a dot:

[tiny-pangolin]

this can be solved by adding by(_time:5m) in the query which will give you give you the count in an hour window so the whole query would be _time:1h {container="myapp", env="dev"} "[ERROR]" | stats by (_time:5m) count()

[leshcat]

Hello, @tiny-pangolin ,

Thanks for reply!

It renders better indeed, but still not the same representation as Loki does.

Type: Range, 6h overview:

Loki:

vLogs:

Total number matches. Perhaps i need to do something with the panel instead?

[tiny-pangolin]

try remove ing _time:1h from the start of your victorialogs query, and change the by(_time:5m) to by(_time:1h) and see if that works. _time:1h is limiting the response to messages sent in the past hour instead of getting the duration from Grafana and the _time in the by should match the duration for count_over_time in your loki query

[leshcat]

try remove ing _time:1h from the start of your victorialogs query, and change the by(_time:5m) to by(_time:1h) and see if that works. _time:1h is limiting the response to messages sent in the past hour instead of getting the duration from Grafana and the _time in the by should match the duration for count_over_time in your loki query

Makes sense, but unfortunately that didn't do the trick and values are now weird:

[dmitryk-dk]

Hi @Heyzi , @leshcat ! Can you check the issue on the latest version of the victorialogs. Is it reproducible?

[tommy-ng0]

still happening on the latest version of VictoriaLogs (victoriametrics/victoria-logs:v1.17.0-victorialogs) by the look of it