Logcli field regex does not return results

[caleb15]

Describe the bug
Logcli field regex behaves in very strange ways contrary to expectation

To Reproduce
Steps to reproduce the behavior:

1. Started Loki (helm chart version 2.3.0, which was latest last time I checked)
2. Started Promtail (helm chart version 3.0.5, which was latest last time I checked) to tail '...'
3. Query: logcli query '{app="nginx",job="fifteen5/nginx"} | json | log=~".*"'

Expected behavior
All nginx logs to be returned.

Environment:

• Infrastructure: kubernetes
• Deployment tool: helm

Screenshots, Promtail config, or terminal output
If applicable, add any output to help explain your problem.

The same query on a different field worked:
logcli query '{app="nginx",job="fifteen5/nginx"} | json | stream=~".*"'

Using an exact match works:
{app="nginx",job="fifteen5/nginx"} | json | log="10.51.82.226 - - [04/Mar/2021:01:33:52 +0000] \"GET / HTTP/1.1\" 404 118 \"-\" \"ELB-HealthChecker/2.0\"\n"

Here's an example of the log line that should be showing up:
{"log":"10.51.82.226 - - [04/Mar/2021:01:33:52 +0000] \"GET / HTTP/1.1\" 404 118 \"-\" \"ELB-HealthChecker/2.0\"\n","stream":"stdout","time":"2021-03-04T01:33:52.615363491Z"}

[caleb15]

ohhhh wait maybe this is it:

https://prometheus.io/docs/prometheus/latest/querying/basics/

Vector selectors must either specify a name or at least one label matcher that does not match the empty string. The following expression is illegal:

{job=~".*"} # Bad!

That's reallly weird..... .* is a valid regex. :|

[caleb15]

I had other problems with it too, I'll have to go back and test this again.

[caleb15]

ah {app="nginx"} | json | log=~".+" still fails (as in returns no logs when it should)

[caleb15]

What's also weird is if .* is invalid why would it work for stream but not log? I feel like there's either a bug or I'm missing something major here 🤔

[paaacman]

Workaround : use line_format to access Line filter:
{app="nginx",job="fifteen5/nginx"} | json | line_format "{{.log}}" |= "is not found"

[caleb15]

I found the reason - the newline in the log is messing things up.
{app="nginx"} | json | log=~".+\n" works!

[caleb15]

and here's the other part of the puzzle - the prometheus docs say Regex-matches are fully anchored. This explains why partial matches were not working, I have to match the entire string.

[caleb15]

and the last thing I found is if I want . to match newline I can enable the single line flag, like so:
{app="nginx"} | json | log =~ "(?s).*is not found.*"