Query Language
Lakerunner uses query languages inspired by LogQL (opens in a new tab) (for logs) and PromQL (opens in a new tab) (for metrics). If you're familiar with either of these, you'll feel right at home — but note that Lakerunner supports a subset of their operators and syntax. We do not currently have full 1-to-1 compatibility with LogQL or PromQL.
Log Queries (LogQL-style)
Log queries retrieve and filter log entries. A query starts with a stream selector and can be followed by pipeline stages.
Stream Selectors
Stream selectors filter logs by label. They are enclosed in curly braces:
{label="value"}Supported matching operators
| Operator | Description |
|---|---|
= | Equals |
!= | Not equals |
=~ | Regex match |
!~ | Regex does not match |
Examples
{resource_service_name="api-server"}{environment="prod", resource_service_name=~"api-.*"}{environment!="dev"}Line Filter Expressions
After a stream selector, you can apply line filters to match or exclude log content:
| Operator | Description |
|---|---|
|= | Line contains string |
!= | Line does not contain string |
|~ | Line matches regex |
!~ | Line does not match regex |
Examples
{resource_service_name="api-server"} |= "error"{resource_service_name="api-server"} !~ "debug|trace"{environment="prod"} |= "timeout" != "expected timeout"Label Filter Expressions
Use label filters to refine results based on parsed or indexed labels:
{resource_service_name="api-server"} | log_level="ERROR"{environment="prod"} | status_code >= 500Metric Queries (PromQL-style)
Metric queries allow you to aggregate and compute over your observability data. These follow PromQL-style syntax.
Selectors
Metric selectors use the same matching operators as log stream selectors:
http_requests_total{method="GET", status="200"}cpu_usage{instance=~"web-.*"}Common Aggregation Operators
| Operator | Description |
|---|---|
sum | Sum across series |
avg | Average across series |
min | Minimum value |
max | Maximum value |
count | Count of series |
rate | Per-second average rate of increase |
Examples
sum(rate(http_requests_total{environment="prod"}[5m]))avg by (service) (cpu_usage)Range Vectors
Range vectors select a range of samples back from the current instant. Durations are specified in square brackets:
| Unit | Meaning |
|---|---|
s | Seconds |
m | Minutes |
h | Hours |
d | Days |
rate(http_requests_total[5m])Binary Operators
| Operator | Description |
|---|---|
+ | Addition |
- | Subtraction |
* | Multiplication |
/ | Division |
> | Greater than |
< | Less than |
>= | Greater than or equal |
<= | Less than or equal |
== | Equal |
!= | Not equal |
Supported Subset
Lakerunner implements a subset of the full LogQL and PromQL specifications. While we continue to expand coverage, some advanced operators and functions may not yet be available. If you encounter an unsupported expression, reach out to our team and we'll be happy to help find an alternative or prioritize support.
For the complete specification of each language, refer to the official documentation:
- LogQL Documentation (opens in a new tab) — Grafana Loki's query language for logs
- PromQL Documentation (opens in a new tab) — Prometheus's query language for metrics
Reach out to support@cardinalhq.io for support or to ask questions not answered in our documentation.