Predicate operators

Label filter expressions filter log lines by comparing label values — both original stream labels and labels extracted by parsers. LogQL infers the comparison type from the literal: quoted strings compare as text, bare numbers as numbers, values with duration units (5ms, 1h) as durations, and values with size units (2KB, 1GiB) as byte counts. Combine predicates with and, or, or a comma.

Bytes comparison

Compares a label value as a byte size when the literal carries a size unit such as 512B, 1KB, or 2GiB. Plain numeric label values are treated as byte counts, so response-size fields from access logs work without conversion.

Syntax

| <label> > <size>    (also ==, !=, >=, <, <=)
none

Parameters

Parameter Required Description

<label>

Required

A label whose value is a byte count or size string.

<size>

Required

A size literal with a unit: B, KB, MB, GB, KiB, MiB, and so on.

Example

Extract the response size from nginx access logs and keep responses larger than one kilobyte.

{source="nginx"}
| regexp "\" (?P<status>[0-9]{3}) (?P<resp_bytes>[0-9]+)"
| resp_bytes > 1KB
Expected output
10.20.10.88 - - [04/Jul/2026:15:41:48 +0000] "POST /ingester/api/v1/filebeat/_bulk HTTP/1.1" 200 4848 "-" "Ela ...
10.20.10.88 - - [04/Jul/2026:15:41:48 +0000] "POST /ingester/api/v1/filebeat/_bulk HTTP/1.1" 200 4848 "-" "Ela ...
10.20.10.88 - - [04/Jul/2026:15:41:48 +0000] "POST /ingester/api/v1/filebeat/_bulk HTTP/1.1" 200 4848 "-" "Ela ...
none

1KB is 1000 bytes; use 1KiB for 1024.

Duration comparison

Compares a label value as a duration when the literal carries a duration unit such as 300ms, 1.5s, or 2h. Label values in Go duration format (28.82661ms) are parsed automatically, making this the natural filter for latency fields.

Syntax

| <label> > <duration>    (also ==, !=, >=, <, <=)
none

Parameters

Parameter Required Description

<label>

Required

A label whose value is a duration string, such as duration=28.8ms extracted by logfmt.

<duration>

Required

A duration literal with a unit: ns, us, ms, s, m, h.

Example

Find slow Loki datasource requests in Grafana logs — anything that took longer than 10 milliseconds.

{source="grafana"} |= "duration=" | logfmt | duration > 10ms
Expected output
logger=context userId=0 orgId=0 uname= t=2026-07-04T15:41:43.03381621Z level=info msg="Request Completed" meth ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseQLDatasource dsUID=P5BE00A3D5765370D uname=grafa ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseQLDatasource dsUID=P5BE00A3D5765370D uname=grafa ...
none

The comparison type comes from the literal: 10ms triggers duration parsing, a bare 10 compares numerically.

Combining filters (and, or)

Combines multiple label filter predicates in one expression. and requires both sides to hold — a comma or a space between predicates means the same thing — while or matches when either side holds. Use parentheses to group nested conditions.

Syntax

| <predicate> and <predicate> [or <predicate>]
none

Parameters

Parameter Required Description

<predicate>

Required

Any label filter comparison: string, numeric, duration, or bytes.

Example

Keep Grafana datasource requests that were both slow (over 5 ms) and successful (status 200).

{source="grafana"} |= "duration="
| logfmt
| duration > 5ms and statusCode="200"
Expected output
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
none

| duration > 5ms, statusCode="200" and | duration > 5ms | statusCode="200" are equivalent ways to write the same and.

Numeric comparison

Compares a label value as a number using ==, !=, >, >=, <, or ⇐. The label’s string value is converted to a number for the comparison; lines whose value does not parse get the __error__ label instead of matching.

Syntax

| <label> >= <number>    (also ==, !=, >, <, <=)
none

Parameters

Parameter Required Description

<label>

Required

A label whose value is numeric text, typically extracted by a parser.

<number>

Required

An unquoted integer or float literal.

Example

Extract the HTTP status code from nginx access logs and keep only client and server errors (status 400 and above).

{source="nginx"}
| regexp "\" (?P<status>[0-9]{3}) (?P<resp_bytes>[0-9]+)"
| status >= 400
Expected output
10.20.15.214 - - [04/Jul/2026:15:41:41 +0000] "POST /ingester/otlp/v1/logs HTTP/2.0" 403 0 "-" "OpenTelemetry  ...
10.2.130.201 - - [04/Jul/2026:15:41:40 +0000] "POST /ingester/otlp/v1/logs HTTP/1.1" 403 0 "-" "OpenTelemetry  ...
10.2.135.177 - zd3150 [04/Jul/2026:15:41:40 +0000] "POST /write HTTP/1.1" 403 0 "-" "vmagent" 527 0.001 [kfuse ...
none

Use == for numeric equality; a single = compares as a string.

String comparison

Compares a label value against a quoted string using =, !=, =~, or !~. String label filters work on both original stream labels and labels extracted by parsers, which makes them the standard way to filter on parsed fields mid-pipeline.

Syntax

| <label> = "<value>"    (also !=, =~, !~)
none

Parameters

Parameter Required Description

<label>

Required

A stream label or a label extracted earlier in the pipeline.

<value>

Required

A quoted string for =/!=, or an anchored RE2 regular expression for =/!.

Example

Parse Grafana datasource logs and keep only the queryData endpoint, using the endpoint label created by the logfmt parser.

{source="grafana"} |= "duration=" | logfmt | endpoint="queryData"
Expected output
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseQLDatasource dsUID=P5BE00A3D5765370D uname=grafa ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseQLDatasource dsUID=P5BE00A3D5765370D uname=grafa ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseQLDatasource dsUID=P5BE00A3D5765370D uname=grafa ...
none

Multiple label filters can be chained; see the combining filters operator for and/or semantics.