<p>I'm using zerolog in golang, which outputs json formatted log, the app is running on k8s, and has cri-o format as following.
<a href="https://i.stack.imgur.com/M1qMe.png" rel="nofollow noreferrer">actual log screenshot on Grafana loki</a></p>
<p>My question is, since there's some non-json text prepended to my json log, I can't seem to effectively query the log, one example is, when I tried to pipe the log into logfmt, exceptions were thrown.</p>
<p>What I want is to be able to query into the sub field of the json.
My intuition is to maybe for each log, only select the parts from <code>{</code> (start of the json), then maybe I can do more interesting manipulation. I'm a bit stuck and not sure what's the best way to proceed.</p>
<p>Any help and comments is appreciated.</p>

dexian
<p>after some head scratching, problem solved.</p>
<p>As I'm directly using the promtail setup from here <a href="https://raw.githubusercontent.com/grafana/loki/master/tools/promtail.sh" rel="nofollow noreferrer">https://raw.githubusercontent.com/grafana/loki/master/tools/promtail.sh</a></p>
<p>And within this setup, the default parser is docker, but we need to change it to <code>cri</code>, afterwards, the logs are properly parsed as json in my Grafana dashboard</p>
