Transform operators

Formatting expressions rewrite the log line or its label set mid-pipeline: render a new line from a template, rename or compute labels, strip ANSI color codes, and drop or keep labels. line_format and label_format accept Go template syntax with access to all labels.

decolorize

Removes ANSI terminal color codes from the log line, leaving plain text. Development tools and container runtimes often emit colored output; decolorize makes such lines readable in query results and safe for downstream parsing.

Syntax

| decolorize
none

Example

Strip any color escape sequences from JVM garbage-collection log lines before reading them.

{source="busybox"} | decolorize
Expected output
[1728193.358s][info][gc] GC(89702) Pause Young (Mixed) (G1 Evacuation Pause) 32237M->7943M(40960M) 52.316ms
[2486072.473s][info][gc] GC(168886) Pause Young (Normal) (G1 Evacuation Pause) 40968M->12435M(49152M) 37.498ms
[1980334.497s][info][gc] GC(98036) Pause Young (Normal) (G1 Evacuation Pause) 33254M->9208M(40960M) 32.426ms
none

Lines without color codes pass through unchanged, so decolorize is safe to apply unconditionally.

drop

Removes the named labels from each line’s label set. Use it after a parser that extracted more fields than you need — fewer labels means fewer distinct series when the pipeline feeds a metric query, and less noise in log results.

Syntax

| drop <label> [, <label> ...] [, <label>="<value>"]
none

Parameters

Parameter Required Description

<label>

Required

One or more label names to remove.

<label>="<value>"

Optional

Conditional form: the label is dropped only on lines where it equals the given value.

Example

Parse Filebeat JSON events, then drop the source-code location fields that the json parser extracted but the investigation does not need.

{source="filebeat"}
| json
| drop log_origin_file_name, log_origin_file_line
Expected output
{"log.level":"info","@timestamp":"2026-07-04T15:36:22.411Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:36:52.410Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:37:52.411Z","log.logger":"monitoring","log.origin":{"file.name ...
none

drop affects only the pipeline label set, not the stored log data.

When most labels should go, keep is the shorter way to express the same intent.

keep

Removes every label except the ones named. keep is the complement of drop: state what you want instead of what you do not, which is usually shorter after a parser that extracts many fields.

Syntax

| keep <label> [, <label> ...] [, <label>="<value>"]
none

Parameters

Parameter Required Description

<label>

Required

One or more label names to retain; all other labels are removed.

<label>="<value>"

Optional

Conditional form: the label is kept only on lines where it equals the given value.

Example

Parse Filebeat JSON events and reduce the label set to just the log level and message.

{source="filebeat"} | json | keep log_level, message
Expected output
{"log.level":"info","@timestamp":"2026-07-04T15:41:52.411Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:41:22.410Z","log.logger":"monitoring","log.origin":{"file.name ...
{"log.level":"info","@timestamp":"2026-07-04T15:40:52.410Z","log.logger":"monitoring","log.origin":{"file.name ...
none

Stream labels can be kept or removed like any other label — keep applies to the whole label set.

label_format

Renames a label or assigns it a value rendered from a Go template. label_format status=statusCode renames statusCode to status; a double-quoted right-hand side is treated as a template, so labels can also be derived from other labels.

Syntax

| label_format <new>=<old> [, <label>="<template>"]
none

Parameters

Parameter Required Description

<new>=<old>

Required

Renames label <old> to <new>. The right-hand side is a bare label name.

<label>="<template>"

Optional

Sets <label> to the rendered Go template value; reference other labels as {{.label}}.

Example

Rename the parsed statusCode label to the shorter status and keep only successful requests using the new name.

{source="grafana"} |= "duration="
| logfmt
| label_format status=statusCode
| status="200"
Expected output
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
logger=tsdb.loki endpoint=queryData pluginId=loki dsName=KfuseLogsDatasource dsUID=P10239062BE9ED4EF uname=gra ...
none

Renaming with a bare label name moves the value — the old label is removed.

Multiple assignments in one label_format are separated by commas, but a label can be assigned only once per stage.

line_format

Replaces the log line with text rendered from a Go template. The template can reference any label as {{.label}}, which makes line_format the tool for trimming noisy lines down to the fields that matter, or for assembling a new line from parsed fields.

Syntax

| line_format "<template>"
none

Parameters

Parameter Required Description

<template>

Required

A Go template string. {{.label}} inserts a label value; template functions such as upper, trunc, and printf are available.

Example

Reduce verbose Grafana datasource lines to a compact summary built from three parsed fields.

{source="grafana"} |= "duration="
| logfmt
| line_format "{{.level}} {{.endpoint}} took {{.duration}}"
Expected output
info queryData took 96.062µs
info queryData took 213.193168ms
info queryData took 128.308µs
none

line_format changes only the line content; the label set is untouched.

A pipeline stage after line_format sees the new line — including line filters and parsers.