### Get VictoriaLogs Help and Configuration Info

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Displays the help message for VictoriaLogs, listing all supported command-line flags, their descriptions, and default values. This is used to understand configuration options.

```bash
/path/to/victoria-logs -help
```

--------------------------------

### Run VictoriaLogs using Docker Image

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Starts VictoriaLogs in a Docker container, mapping the necessary port and volume for data storage. This is a simple way to begin using VictoriaLogs.

```bash
docker run --rm -it -p 9428:9428 -v ./victoria-logs-data:/victoria-logs-data \
docker.io/victoriametrics/victoria-logs:v1.43.1 -storageDataPath=victoria-logs-data
```

--------------------------------

### Build VictoriaLogs from Source (Requires Go)

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Builds the VictoriaLogs executable from source code using the 'make' command. This requires Go to be installed on the system.

```bash
make victoria-logs
```

--------------------------------

### Build VictoriaLogs using Docker Builder

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Builds the victoria-logs-prod executable using a Docker builder container, which does not require Go to be installed locally. Docker must be installed.

```bash
make victoria-logs-prod
```

--------------------------------

### Run VictoriaLogs with Pre-built Binaries (Linux/amd64)

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Downloads, unpacks, and runs the VictoriaLogs pre-built binary for Linux amd64. This method has no external dependencies and automatically adapts to system resources.

```bash
curl -L -O https://github.com/VictoriaMetrics/VictoriaLogs/releases/download/v1.43.1/victoria-logs-linux-amd64-v1.43.1.tar.gz
tar xzf victoria-logs-linux-amd64-v1.43.1.tar.gz
./victoria-logs-prod -storageDataPath=victoria-logs-data
```

--------------------------------

### Run VictoriaLogs from Built Binary

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Executes the VictoriaLogs binary that has been built from source. It specifies the data storage path.

```bash
bin/victoria-logs -storageDataPath=victoria-logs-data
```

--------------------------------

### Start vlstorage Node

Source: https://docs.victoriametrics.com/victorialogs/cluster

Starts a `vlstorage` node, which listens on a specified HTTP port and stores data in a given directory.

```APIDOC
## Start vlstorage Node

Starts a single `vlstorage` node. This node accepts incoming requests on the specified HTTP listen address and stores ingested logs in the provided storage data path. The process is started in the background.

### Method
N/A (Command Execution)

### Endpoint
N/A (Local Process)

### Parameters
#### Command-line Flags
- **-httpListenAddr** (string) - Required - The address and port for the node to listen on (e.g., `:9491`).
- **-storageDataPath** (string) - Required - The directory where the node will store its data (e.g., `victoria-logs-data-1`).

### Request Example
```bash
./victoria-logs-prod -httpListenAddr=:9491 -storageDataPath=victoria-logs-data-1 &
```

### Response
N/A (Background process started)
```

--------------------------------

### Start vlselect Node

Source: https://docs.victoriametrics.com/victorialogs/cluster

Starts a `vlselect` node that accepts query requests and retrieves data from `vlstorage` nodes.

```APIDOC
## Start vlselect Node

Starts a `vlselect` node. This node accepts incoming query requests on its HTTP listen address and fetches the necessary data from the specified `vlstorage` nodes. The process is started in the background.

### Method
N/A (Command Execution)

### Endpoint
N/A (Local Process)

### Parameters
#### Command-line Flags
- **-httpListenAddr** (string) - Required - The address and port for the `vlselect` node to listen on (e.g., `:9471`).
- **-storageNode** (string) - Required - A comma-separated list of `vlstorage` node addresses (e.g., `localhost:9491,localhost:9492`).

### Request Example
```bash
./victoria-logs-prod -httpListenAddr=:9471 -storageNode=localhost:9491,localhost:9492 &
```

### Response
N/A (Background process started)
```

--------------------------------

### Clone VictoriaLogs Repository

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Clones the VictoriaLogs source code repository from GitHub. This is the first step for building VictoriaLogs from source.

```bash
git clone https://github.com/VictoriaMetrics/VictoriaLogs
cd VictoriaLogs
```

--------------------------------

### Start VictoriaLogs with Syslog TCP and UDP Listen Addresses

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

This command starts VictoriaLogs, enabling it to receive Syslog data simultaneously via TCP and UDP on port 514. This allows for flexible log ingestion from different sources.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.listenAddr.udp=:514

```

--------------------------------

### LogsQL Comments Example

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

Demonstrates how to use comments in LogsQL queries. Comments start with '#' and extend to the end of the line, aiding in query readability and explanation.

```logsQL
      error                               # find logs with `error` word
  | stats by (_stream) count() logs # then count the number of logs per `_stream` label
  | sort by (logs) desc             # then sort by the found logs in descending order
  | limit 5                         # and show top 5 streams with the biggest number of logs
    
```

--------------------------------

### Start VictoriaLogs Storage Node

Source: https://docs.victoriametrics.com/victorialogs/cluster/index

This command starts a `vlstorage` node for VictoriaLogs. It listens on port 9491 for incoming requests and stores data in the 'victoria-logs-data-1' directory. The '&' runs the process in the background.

```bash
./victoria-logs-prod -httpListenAddr=:9491 -storageDataPath=victoria-logs-data-1 &
```

--------------------------------

### Build vlagent Locally

Source: https://docs.victoriametrics.com/victorialogs/vlagent

Builds the vlagent binary from the source code. This requires Go to be installed on the system. The resulting binary will be placed in the 'bin' directory.

```makefile
make vlagent
```

--------------------------------

### Start vlinsert Node

Source: https://docs.victoriametrics.com/victorialogs/cluster

Starts a `vlinsert` node responsible for accepting logs and distributing them across `vlstorage` nodes.

```APIDOC
## Start vlinsert Node

Starts a `vlinsert` node. This node accepts incoming logs on its HTTP listen address and distributes them evenly across the specified `vlstorage` nodes. The process is started in the background.

### Method
N/A (Command Execution)

### Endpoint
N/A (Local Process)

### Parameters
#### Command-line Flags
- **-httpListenAddr** (string) - Required - The address and port for the `vlinsert` node to listen on (e.g., `:9481`).
- **-storageNode** (string) - Required - A comma-separated list of `vlstorage` node addresses (e.g., `localhost:9491,localhost:9492`).

### Request Example
```bash
./victoria-logs-prod -httpListenAddr=:9481 -storageNode=localhost:9491,localhost:9492 &
```

### Response
N/A (Background process started)
```

--------------------------------

### Calculate Stats by Time Buckets

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

This example calculates the number of logs and unique IP addresses per minute (`_time:1m`) over the last 5 minutes, aliased as `logs_total` and `ips_total`.

```LogsQL
      _time:5m | stats by (_time:1m) count() logs_total, count_uniq(ip) ips_total
    
```

--------------------------------

### Start VictoriaLogs Insert Node

Source: https://docs.victoriametrics.com/victorialogs/cluster/index

This command starts the `vlinsert` node, responsible for receiving logs and distributing them to the configured storage nodes. It listens on port 9481 and directs data to the two `vlstorage` nodes.

```bash
./victoria-logs-prod -httpListenAddr=:9481 -storageNode=localhost:9491,localhost:9492 &
```

--------------------------------

### Start VictoriaLogs with Syslog TCP Listen Address

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

This command starts VictoriaLogs and configures it to listen for Syslog messages on TCP port 514 on all available network interfaces. It supports RFC3164 and RFC5424 formats.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514

```

--------------------------------

### Query Stream Field Values with cURL

Source: https://docs.victoriametrics.com/victorialogs/querying/index

This example shows how to use `curl` to query for specific field values within logs, given a query and time range. It includes an example with a `limit` parameter and how to set tenant IDs.

```bash
curl http://localhost:9428/select/logsql/stream_field_values -d 'query=error' -d 'start=5m' -d 'field=host'

```

```bash
curl http://localhost:9428/select/logsql/stream_field_values -H 'AccountID: 12' -H 'ProjectID: 34' -d 'query=_time:5m'

```

--------------------------------

### Configure Compression for Syslog Ingestion

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

Enable compression for syslog messages ingested by VictoriaLogs. Supported methods include 'none', 'zstd', 'gzip', and 'deflate'. This example configures gzip compression for TCP.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.compressMethod.tcp=gzip
```

--------------------------------

### Build vlogscli-prod with Make and Docker

Source: https://docs.victoriametrics.com/victorialogs/querying/vlogscli/index

Builds the `vlogscli-prod` binary using the Make utility within a Docker container. This method does not require a local Go installation but needs Docker to be installed.

```bash
make vlogscli-prod
```

--------------------------------

### Loki Push API Endpoint

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/promtail

The primary endpoint for pushing logs to VictoriaLogs using a Loki-compatible client. This example shows a basic configuration.

```APIDOC
## POST /insert/loki/api/v1/push

### Description
This endpoint receives log data in the Loki push format from compatible log shippers.

### Method
POST

### Endpoint
`/insert/loki/api/v1/push`

### Parameters
#### Query Parameters
- **disable_message_parsing** (boolean) - Optional - If set to `1`, disables automatic JSON parsing of log messages. Default is `false`.
- **_stream_fields** (string) - Optional - A comma-separated list of labels to be treated as stream fields. Other labels are stored as log fields.
- **debug** (boolean) - Optional - If set to `1`, enables debug logging in VictoriaLogs for ingestion. Default is `false`.
- **ignore_fields** (string) - Optional - A comma-separated list of fields to ignore during ingestion.

#### Request Body
This endpoint expects a standard Loki push request body, typically containing streams of log lines with labels and timestamps.

### Request Example
```json
{
  "streams": [
    {
      "stream": {
        "job": "myjob",
        "instance": "myinstance"
      },
      "values": [
        [
          "1678886400000000000",
          "log line 1"
        ],
        [
          "1678886460000000000",
          "log line 2 with {\"key\": \"value\"}"
        ]
      ]
    }
  ]
}
```

### Response
#### Success Response (200)
An empty response with a 200 OK status indicates successful ingestion.

#### Response Example
(No content on success)
```

--------------------------------

### Query Log Range Stats using curl

Source: https://docs.victoriametrics.com/victorialogs/querying

This example demonstrates how to query log range statistics using the curl command-line tool. It specifies the query, start time, end time, and step interval to retrieve log counts per level over a 24-hour period with 6-hour granularity.

```shell
curl http://localhost:9428/select/logsql/stats_query_range -d 'query=* | stats by (level) count(*)' -d 'start=2024-01-01Z' -d 'end=2024-01-02Z' -d 'step=6h'
```

--------------------------------

### Query Tenant IDs with cURL

Source: https://docs.victoriametrics.com/victorialogs/querying/index

This example demonstrates how to query for tenant IDs within a specified time range using `curl`. It highlights the requirement to call this endpoint with an empty `AccountID` header for security.

```bash
curl http://localhost:9428/select/tenant_ids?start=<start>&end=<end>

```

--------------------------------

### Journald Setup

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/journald

Configure systemd-journal-upload to send logs to VictoriaLogs by setting the URL in `/etc/systemd/journal-upload.conf`.

```APIDOC
## POST /insert/journald

### Description
This endpoint receives journald logs formatted for ingestion into VictoriaLogs.

### Method
POST

### Endpoint
/insert/journald

### Parameters
#### Query Parameters
- **-journald.timeField** (string) - Optional - Specifies a custom journald field to use as the timestamp for logs.
- **-journald.streamFields** (string) - Optional - A comma-separated list of journald fields to use as stream fields.
- **-journald.ignoreFields** (string) - Optional - A comma-separated list of journald fields to ignore during ingestion. Can use wildcard `*`.
- **-journald.tenantID** (string) - Optional - Specifies the tenant ID in the format `AccountID:ProjectID` for storing logs.

#### Request Body
(Journald log data in a format compatible with VictoriaLogs)

### Request Example
(Example request body depends on journald log format and VictoriaLogs ingestion protocol)

### Response
#### Success Response (200)
(Indicates successful ingestion of logs)

#### Response Example
(Example success response)

### Headers
#### Optional Headers (systemd-journal-upload v258+)
- **VL-Time-Field** (string) - Specifies a custom journald field to use as the timestamp for logs.
- **VL-Stream-Fields** (string) - A comma-separated list of journald fields to use as stream fields.
- **VL-Ignore-Fields** (string) - A comma-separated list of journald fields to ignore during ingestion.
- **AccountID** (string) - The Account ID for multitenancy.
- **ProjectID** (string) - The Project ID for multitenancy.
- **Compression** (string) - Specifies the compression algorithm and level (e.g., `zstd:4`, `lz4:2`).
```

--------------------------------

### Start VictoriaLogs Select Node

Source: https://docs.victoriametrics.com/victorialogs/cluster/index

This command initiates the `vlselect` node, which handles incoming queries and retrieves data from the storage nodes. It listens on port 9471 and fetches data from the specified `vlstorage` nodes.

```bash
./victoria-logs-prod -httpListenAddr=:9471 -storageNode=localhost:9491,localhost:9492 &
```

--------------------------------

### Configure vlagent for Multitenancy (Internal Insert)

Source: https://docs.victoriametrics.com/victorialogs/vlagent

Command to start vlagent and store logs using the internal insert endpoint, which accepts logs with arbitrary tenants.

```bash
./vlagent -remoteWrite.url=http://victoria-logs:9428/internal/insert
    
```

--------------------------------

### VictoriaLogs Query API Examples

Source: https://docs.victoriametrics.com/victorialogs/querying/index

Examples of using the VictoriaLogs query API with curl, demonstrating basic queries, piping to standard Unix commands, and advanced filtering.

```APIDOC
## VictoriaLogs Query API

VictoriaLogs provides a querying API that integrates well with command-line tools like `curl` due to its streaming and adaptive query execution features.

### Method
GET

### Endpoint
`/select/logsql/query`

### Description
This endpoint allows you to query logs using a SQL-like syntax. The API supports streaming responses, adaptive query execution based on client consumption speed, and automatic query cancellation when the client closes the connection.

### Query Parameters

- **query** (string) - Required - The log query string. This can include keywords, field-value pairs, and pipe operators like `limit` and `stats`.

### Request Example (Basic Query)
```bash
curl http://localhost:9428/select/logsql/query -d 'query=error'
```

### Request Example (Piping to `head`)
This example retrieves the first 10 log entries matching 'error'. The `head` command closes the stream, automatically canceling the VictoriaLogs query.
```bash
curl http://localhost:9428/select/logsql/query -d 'query=error' | head -10
```

### Request Example (Using `limit` pipe)
This example limits the number of returned logs directly at the VictoriaLogs server side.
```bash
curl http://localhost:9428/select/logsql/query -d 'query=error | limit 10'
```

### Request Example (Piping to `less`)
This demonstrates using `less` for interactive log exploration. VictoriaLogs suspends the query when `less` is not actively reading.
```bash
curl http://localhost:9428/select/logsql/query -d 'query=error' | less
```

### Request Example (Advanced Filtering and Counting)
This query counts log messages with 'error' and the field `app="nginx"` within the last 5 minutes.
```bash
curl http://localhost:9428/select/logsql/query -d 'query={app="nginx"} AND _time:5m AND error' | wc -l
```

### Request Example (Using `stats` pipe for counting)
This example uses the `stats` pipe to count logs directly on the VictoriaLogs server.
```bash
curl http://localhost:9428/select/logsql/query -d 'query={app="nginx"} AND _time:5m AND error | stats count() logs_with_error'
```

### Request Example (Sorting with `jq` and `sort`)
This example extracts `_time` and `_msg` fields, sorts them, and then pipes the output to `less` for viewing.
```bash
curl http://localhost:9428/select/logsql/query -d 'query=error' | jq -r '._time + " " + ._msg' | sort | less
```

### Response
Responses are streamed as soon as matching log entries are found. The format is typically JSON objects, one per log entry, unless modified by pipe operators like `stats`.

#### Success Response (200)
- **_time** (string) - Timestamp of the log entry.
- **_msg** (string) - The log message content.
- Other fields as present in the log data.

#### Response Example (Single Log Entry)
```json
{
  "_time": "2023-10-27T10:00:00Z",
  "_msg": "An example error message.",
  "app": "my_app"
}
```

#### Response Example (Stats command)
```json
{
  "logs_with_error": 12345
}
```

### Note
When using `curl` or similar tools, the `query` parameter value should be percent-encoded if it contains special characters. The `vlogscli` tool handles this encoding automatically.
```

--------------------------------

### Install MacOS Utilities for Release

Source: https://docs.victoriametrics.com/victorialogs/release-guide/index

Installs GNU versions of zip, tar, and sha256sum on MacOS using Homebrew. Ensures these utilities are available in the PATH for release processes.

```bash
brew install coreutils
brew install gnu-tar
export PATH="/usr/local/opt/coreutils/libexec/gnubin:$PATH"

```

--------------------------------

### Build vlogscli with Make

Source: https://docs.victoriametrics.com/victorialogs/querying/vlogscli/index

Builds the `vlogscli` binary using the Make utility. This method requires Go to be installed on the system.

```bash
make vlogscli
```

--------------------------------

### Example LogsQL Query with Pipes

Source: https://docs.victoriametrics.com/victorialogs/logsql

This example demonstrates a LogsQL query that uses a combination of 'stats', 'sort', and 'limit' pipes to find the top 10 log streams with the highest number of logs in the last 5 minutes. It showcases how pipes can be chained to perform complex data analysis.

```LogsQL
_time:5m | stats by (_stream) count() per_stream_logs | sort by (per_stream_logs desc) | limit 10

```

--------------------------------

### VictoriaLogs Alerting Rule Examples (YAML)

Source: https://docs.victoriametrics.com/victorialogs/vmalert/index

Example configurations for alerting rules using VictoriaLogs (vlogs) type. These rules specify conditions based on log data and define alerts with annotations.

```yaml
groups:
  - name: ServiceLog
    type: vlogs
    interval: 5m
    rules:
      - alert: HasErrorLog
        expr: 'env: "prod" AND status:~"error|warn" | stats by (service, kubernetes.pod) count() as errorLog | filter errorLog:>0'
        annotations:
          description: 'Service {{$labels.service}} (pod {{ index $labels "kubernetes.pod" }}) generated {{$labels.errorLog}} error logs in the last 5 minutes'

  - name: ServiceRequest
    type: vlogs
    interval: 5m
    rules:
      - alert: TooManyFailedRequest
        expr: '* | extract "ip=<ip> " | extract "status_code=<code>;" | stats by (ip) count() if (code:~4.*) as failed, count() as total| math failed / total as failed_percentage| filter failed_percentage :> 0.01 | fields ip,failed_percentage'
        annotations:
          description: "Connection from address {{$labels.ip}} has {{$value}}% failed requests in the last 5 minutes"
    

```

--------------------------------

### Calculate Stats Grouped by Fields

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

This example demonstrates calculating `count()` and `count_uniq(ip)` grouped by the `host` and `path` fields. The `by` keyword is used to specify the grouping fields.

```LogsQL
      _time:5m | stats by (host, path) count() logs_total, count_uniq(ip) ips_total
    
```

--------------------------------

### SQL for Top N Values vs. LogsQL Top Pipe Shortcut

Source: https://docs.victoriametrics.com/victorialogs/sql-to-logsql/index

Demonstrates the conversion of a common SQL pattern for finding top N values using GROUP BY, ORDER BY, and LIMIT into the concise LogsQL 'top' pipe shortcut.

```SQL
SELECT user_id, count(*) hits FROM table GROUP BY user_id ORDER BY hits DESC LIMIT 5
```

--------------------------------

### Calculate Running Stats on Time Buckets

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

This example first calculates per-minute log counts (`hits`) and then uses the `running_stats` pipe to calculate the cumulative sum of hits, aliased as `running_hits`.

```LogsQL
      _time:5m
    | stats by (_time:1m) count() as hits
    | running_stats sum(hits) as running_hits
    
```

--------------------------------

### Promtail Configuration for VictoriaLogs

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/promtail/index

This section details how to configure the `clients` section in Promtail's configuration file to send logs to VictoriaLogs. It covers the basic setup, disabling JSON parsing, customizing stream fields, enabling debug mode, ignoring specific fields, and specifying tenant IDs.

```APIDOC
## POST /insert/loki/api/v1/push

### Description
This endpoint is used by log shippers like Promtail to push log data to VictoriaLogs in the Loki push format.

### Method
POST

### Endpoint
/insert/loki/api/v1/push

### Query Parameters
- **disable_message_parsing** (boolean) - Optional - If set to `1`, disables automatic JSON parsing of log messages, storing them as a string in the `_msg` field.
- **_stream_fields** (string) - Optional - A comma-separated list of labels to be used as log stream fields. Other labels will be stored as regular log fields.
- **debug** (boolean) - Optional - If set to `1`, enables debug logging in VictoriaLogs for this ingestion request, useful for troubleshooting.
- **ignore_fields** (string) - Optional - A comma-separated list of fields to be ignored during data ingestion.

### Request Body
(Loki push request format, typically containing streams with log entries)

### Request Example (Basic Configuration)
```json
{
  "clients": [
    {
      "url": "http://localhost:9428/insert/loki/api/v1/push"
    }
  ]
}
```

### Request Example (Disabling JSON Parsing)
```json
{
  "clients": [
    {
      "url": "http://localhost:9428/insert/loki/api/v1/push?disable_message_parsing=1"
    }
  ]
}
```

### Request Example (Specifying Stream Fields)
```json
{
  "clients": [
    {
      "url": "http://localhost:9428/insert/loki/api/v1/push?_stream_fields=instance,job"
    }
  ]
}
```

### Request Example (Ignoring Fields)
```json
{
  "clients": [
    {
      "url": "http://localhost:9428/insert/loki/api/v1/push?ignore_fields=filename,stream"
    }
  ]
}
```

### Request Example (Specifying Tenant ID)
```json
{
  "clients": [
    {
      "url": "http://localhost:9428/insert/loki/api/v1/push",
      "tenant_id": "12:34"
    }
  ]
}
```

### Response
#### Success Response (200)
Typically returns an empty response body or a minimal success indicator upon successful ingestion.

#### Response Example
(Empty body or status code 200 OK)
```

--------------------------------

### Start Second VictoriaLogs Storage Node

Source: https://docs.victoriametrics.com/victorialogs/cluster/index

This command initiates a second `vlstorage` node. It's configured to listen on port 9492 and utilize 'victoria-logs-data-2' for data storage, also running in the background.

```bash
./victoria-logs-prod -httpListenAddr=:9492 -storageDataPath=victoria-logs-data-2 &
```

--------------------------------

### Start VictoriaLogs with TCP Syslog Listener on Port 514

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog

Starts VictoriaLogs, enabling it to accept syslog formatted logs on TCP port 514 across all network interfaces. This is a basic setup for receiving syslog data via TCP.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514
```

--------------------------------

### Calculate Multiple Stats without 'stats' Prefix

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

This example demonstrates an equivalent way to calculate multiple statistics without explicitly using the `stats` keyword. The functionality remains the same as using the `stats` prefix.

```LogsQL
      _time:5m | count() logs_total, count_uniq(_stream) streams_total
    
```

--------------------------------

### Query Streams with Tenant Headers using cURL

Source: https://docs.victoriametrics.com/victorialogs/querying

This example shows how to query for streams while specifying a particular tenant using AccountID and ProjectID HTTP headers. The query targets logs from the last 5 minutes for tenant (AccountID=12, ProjectID=34).

```bash
curl http://localhost:9428/select/logsql/streams -H 'AccountID: 12' -H 'ProjectID: 34' -d 'query=_time:5m'
```

--------------------------------

### Sort Query Results with jq and sort

Source: https://docs.victoriametrics.com/victorialogs/querying

This example demonstrates sorting query results by the `_time` field using `jq` to extract relevant fields and then piping to the `sort` command. The output is then viewable with `less`.

```bash
curl http://localhost:9428/select/logsql/query -d 'query=error' | jq -r '._time + " " + ._msg' | sort | less
```

--------------------------------

### Start VictoriaLogs with TCP Syslog Listener and Custom Timezone

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog

Starts VictoriaLogs with a TCP syslog listener and sets the timezone for parsing RFC3164 timestamps to 'Europe/Berlin'. This ensures accurate timestamp interpretation when logs originate from different time zones.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.timezone='Europe/Berlin'
```

--------------------------------

### HTTP Output Configuration for VictoriaLogs

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/fluentd

This section details the Fluentd HTTP output configuration for sending logs to VictoriaLogs. It covers the basic setup, enabling debug mode, ignoring specific fields, enabling data compression, and specifying a tenant.

```APIDOC
## POST /insert/jsonline

### Description
This endpoint receives log data in JSONL format from Fluentd and ingests it into VictoriaLogs.

### Method
POST

### Endpoint
`http://<victoralogs-host>:<victoralogs-port>/insert/jsonline`

### Query Parameters

*   **debug** (integer) - Optional - Enables debug mode for inspecting log fields during ingestion. Set to `1` to enable.
*   **ignore_fields** (string) - Optional - A comma-separated list of fields to ignore during ingestion. Example: `log.offset,event.original`.

### Headers

*   **VL-Msg-Field** (string) - Required - Specifies the field in the log message to be used as the main log message.
*   **VL-Time-Field** (string) - Required - Specifies the field in the log message to be used as the timestamp.
*   **VL-Stream-Fields** (string) - Required - Specifies fields to be used as stream fields for log organization.
*   **AccountID** (integer) - Optional - Specifies the Account ID for the tenant to store logs in.
*   **ProjectID** (integer) - Optional - Specifies the Project ID for the tenant to store logs in.

### Request Body
Log data in JSON Lines (JSONL) format.

### Request Example (Basic Configuration)
```fluentd
<match **>
  @type http
  endpoint "http://localhost:9428/insert/jsonline"
  headers {"VL-Msg-Field": "log", "VL-Time-Field": "time", "VL-Stream-Fields": "path"}
</match>
```

### Request Example (With Debugging)
```fluentd
<match **>
  @type http
  endpoint "http://localhost:9428/insert/jsonline&debug=1"
  headers {"VL-Msg-Field": "log", "VL-Time-Field": "time", "VL-Stream-Fields": "path"}
</match>
```

### Request Example (Ignoring Fields)
```fluentd
<match **>
  @type http
  endpoint "http://localhost:9428/insert/jsonline&ignore_fields=log.offset,event.original"
  headers {"VL-Msg-Field": "log", "VL-Time-Field": "time", "VL-Stream-Fields": "path"}
</match>
```

### Request Example (With Compression)
```fluentd
<match **>
  @type http
  endpoint "http://localhost:9428/insert/jsonline&ignore_fields=log.offset,event.original"
  headers {"VL-Msg-Field": "log", "VL-Time-Field": "time", "VL-Stream-Fields": "path"}
  compress gzip
</match>
```

### Request Example (Specifying Tenant)
```fluentd
<match **>
  @type http
  endpoint "http://localhost:9428/insert/jsonline"
  headers {"VL-Msg-Field": "log", "VL-Time-Field": "time", "VL-Stream-Fields": "path"}
  header AccountID 12
  header ProjectID 23
</match>
```

### Response

#### Success Response (200)
Typically an empty response or a confirmation of successful ingestion.

#### Response Example
```json
{}
```
```

--------------------------------

### Configure Docker for Multi-Platform Builds

Source: https://docs.victoriametrics.com/victorialogs/release-guide/index

Sets up Docker Buildx for multi-platform image building, specifically using QEMU for emulation. This is a prerequisite for building Docker images on various architectures.

```bash
docker buildx create --use --name=qemu
docker buildx inspect --bootstrap

```

--------------------------------

### DataDog Agent Log Ingestion Configuration

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/datadog-agent/index

Enables log ingestion for the DataDog agent and specifies the VictoriaLogs endpoint (VMAuth) to send collected logs. This setup requires enabling logs and setting the custom URL for log data transmission.

```yaml
logs_enabled: true
logs_config:
  logs_dd_url: "<vmauth-base-url>"
  use_http: true
    

```

--------------------------------

### Filter Kubernetes Logs with vlagent

Source: https://docs.victoriametrics.com/victorialogs/vlagent

Example of starting vlagent with a filter to exclude logs based on Kubernetes pod annotations and namespaces. This demonstrates the use of the -kubernetesCollector.excludeFilter flag.

```bash
./vlagent -remoteWrite.url=http://victoria-logs:9428/insert/native -kubernetesCollector \
  -kubernetesCollector.excludeFilter='kubernetes.pod_annotation.logging.vlagent.io/exclude:=true or kubernetes.pod_namespace:in(test, logging)'
    
```

--------------------------------

### Calculate Stats Grouped by Fields (without 'by' keyword)

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

This example shows an alternative syntax for grouping stats by fields, omitting the `by` keyword. The functionality is identical to using `stats by (field1, field2)`.

```LogsQL
      _time:5m | stats (host, path) count() logs_total, count_uniq(ip) ips_total
    
```

--------------------------------

### VictoriaLogs Time Filter Examples

Source: https://docs.victoriametrics.com/victorialogs/logsql/index

Demonstrates various ways to filter logs by time in VictoriaLogs using the `_time` field. This includes relative durations, specific dates, date ranges, and timezone adjustments. These examples are crucial for optimizing query performance by narrowing down the search scope.

```LogsQL
_time:1h AND error
```

```LogsQL
_time:5m
```

```LogsQL
_time:2.5d15m42.345s
```

```LogsQL
_time:1y
```

```LogsQL
_time:>5m
```

```LogsQL
_time:2023-04-25Z
```

```LogsQL
_time:2023-02Z
```

```LogsQL
_time:2023Z
```

```LogsQL
_time:2023-04-25T22Z
```

```LogsQL
_time:2023-04-25T22:45Z
```

```LogsQL
_time:2023-04-25T22:45:59Z
```

```LogsQL
_time:>2023-01-01Z
```

```LogsQL
_time:>=2023-01-01Z
```

```LogsQL
_time:<2023-12-31Z
```

```LogsQL
_time:<=2023-12-31Z
```

```LogsQL
_time:[2023-04-01Z, 2023-04-30Z]
```

```LogsQL
_time:[2023-02-01Z, 2023-03-01Z)
```

```LogsQL
_time:2023-04-25+05:30
```

```LogsQL
_time:2023-02-07:00
```

```LogsQL
_time:2023-10-20
```

```LogsQL
_time:offset 1h
```

```LogsQL
_time:5m offset 1h
```

```LogsQL
_time:2023-07Z offset 5h30m
```

```LogsQL
_time:[2023-02-01Z, 2023-03-01Z) offset 1w
```

--------------------------------

### Example JSON Output for Log Stats Query

Source: https://docs.victoriametrics.com/victorialogs/querying

This snippet shows an example of the JSON output returned by the /select/logsql/stats_query endpoint. The data is structured in a format compatible with Prometheus's vector result type, containing metrics with labels derived from the 'by(...)' clause.

```json
{
  "status": "success",
  "data": {
    "resultType": "vector",
    "result": [
      {
        "metric": {
          "__name__": "count(*)",
          "level": "info"
        },
        "value": [
          1704153600,
          "20395342"
        ]
      },
      {
        "metric": {
          "__name__": "count(*)",
          "level": "warn"
        },
        "value": [
          1704153600,
          "1239222"
        ]
      },
      {
        "metric": {
          "__name__": "count(*)",
          "level": "error"
        },
        "value": [
          1704153600,
          "832"
        ]
      }
    ]
  }
}
```

--------------------------------

### Query Log Hits Stats with Tenant Headers

Source: https://docs.victoriametrics.com/victorialogs/querying

This example demonstrates how to query log hits statistics for a specific tenant by providing `AccountID` and `ProjectID` in the HTTP headers. This is essential when working with multi-tenant VictoriaLogs deployments. If these headers are omitted, the default tenant is queried.

```Shell
curl http://localhost:9428/select/logsql/hits -H 'AccountID: 12' -H 'ProjectID: 34' -d 'query=error'
```

--------------------------------

### Checkout Specific Commit

Source: https://docs.victoriametrics.com/victorialogs/quickstart/index

Checks out a specific commit hash within the VictoriaLogs repository. This is useful for working with a particular version of the source code.

```bash
git checkout <commit-hash-here>
```

--------------------------------

### Tenant-Specific Log Ingestion

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/promtail

Configuration for sending logs to a specific tenant within VictoriaLogs using the `tenant_id` field.

```APIDOC
## POST /insert/loki/api/v1/push (Tenant Specific)

### Description
This example demonstrates how to specify a target tenant for log ingestion using the `tenant_id` field in the client configuration.

### Method
POST

### Endpoint
`/insert/loki/api/v1/push`

### Parameters
#### Query Parameters
(See Loki Push API Endpoint for standard query parameters)

#### Request Body
(Standard Loki push request body)

#### Client Configuration Extension
- **tenant_id** (string) - Required (in client config) - Specifies the target tenant in the format `AccountID:ProjectID`.

### Request Example (Client Configuration Snippet)
```yaml
clients:
  - url: "http://localhost:9428/insert/loki/api/v1/push"
    tenant_id: "12:34"
```

### Response
#### Success Response (200)
An empty response with a 200 OK status indicates successful ingestion to the specified tenant.

#### Response Example
(No content on success)
```

--------------------------------

### Query Stream Field Names with cURL

Source: https://docs.victoriametrics.com/victorialogs/querying/index

This example demonstrates how to use `curl` to query for stream field names within a specified time range and query. It shows basic usage and how to specify tenant IDs via headers.

```bash
curl http://localhost:9428/select/logsql/stream_field_names -d 'query=error' -d 'start=5m'

```

```bash
curl http://localhost:9428/select/logsql/stream_field_names -H 'AccountID: 12' -H 'ProjectID: 34' -d 'query=_time:5m'

```

--------------------------------

### Example Kubernetes Log Entry Structure

Source: https://docs.victoriametrics.com/victorialogs/keyconcepts/index

This example demonstrates the typical structure of a log entry originating from a Kubernetes container, including common metadata fields and the log message itself. This structure is useful for identifying which fields should be used for defining log streams in VictoriaLogs.

```json
{
  "kubernetes.namespace": "some-namespace",
  "kubernetes.node.name": "some-node",
  "kubernetes.pod.name": "some-pod",
  "kubernetes.container.name": "some-container",
  "_msg": "some log message"
}
```

--------------------------------

### LogsQL Top Pipe Shortcut for Top N Values

Source: https://docs.victoriametrics.com/victorialogs/sql-to-logsql/index

Provides the equivalent LogsQL query using the 'top' pipe shortcut to achieve the same result as the SQL query for finding top N values.

```LogsQL
* | top 5 (user_id)
```

--------------------------------

### Initial Query for Baseline Performance Measurement

Source: https://docs.victoriametrics.com/victorialogs/logsql

This query establishes a baseline performance by selecting all logs within a 5-minute time range and counting them. It serves as the starting point for performance optimization.

```vql
_time:5m | count()
```

--------------------------------

### Get Unique Field Values using field_values Pipe

Source: https://docs.victoriametrics.com/victorialogs/logsql-examples/index

Retrieves all unique values for a given field (e.g., 'level') over the last 5 minutes using the 'field_values' pipe. This is an alternative to 'stats by (field)'.

```LogsQL
_time:5m | field_values level
```

--------------------------------

### Sort Log Results with External Tools

Source: https://docs.victoriametrics.com/victorialogs/querying

This example shows how to retrieve all log entries matching a query and sort them using the `sort` command after piping the output from `curl`. Be aware that this can be time-consuming if the query returns a large number of results.

```shell
curl http://localhost:9428/select/logsql/query -d 'query=error | sort by (_time)' | less
```

--------------------------------

### Configure Custom Stream Fields for Syslog Ingestion

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

Define custom fields to be used as log stream identifiers. This example sets 'hostname' and 'app_name' as stream fields for logs received on TCP port 514.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.streamFields.tcp='["hostname","app_name"]'
```

--------------------------------

### Compression Configuration

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog

Configure VictoriaLogs to accept compressed syslog messages. Supported methods include none, zstd, gzip, and deflate.

```APIDOC
## Compression Configuration

### Description
Configure VictoriaLogs to accept compressed syslog messages via TCP, UDP, or Unix sockets. Use the `-syslog.compressMethod.*` flags to specify the compression method.

### Supported Methods
- `none`: No compression
- `zstd`: zstd compression
- `gzip`: gzip compression
- `deflate`: deflate compression

### Method
Configuration via command-line flags.

### Example Command (gzip on TCP):
```
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.compressMethod.tcp=gzip
```
```

--------------------------------

### Configure Multitenancy for Syslog Ingestion

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

Specify a custom tenant for ingesting syslog messages. This example configures VictoriaLogs to store messages received on TCP port 514 into the tenant with AccountID 12 and ProjectID 34.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.tenantID.tcp=12:34
```

--------------------------------

### Count Log Entries with wc -l

Source: https://docs.victoriametrics.com/victorialogs/querying

This example demonstrates counting the number of log messages matching specific criteria using the `wc -l` Unix command. It queries for logs with the 'error' word and the field `app="nginx"` within the last 5 minutes.

```bash
curl http://localhost:9428/select/logsql/query -d 'query={app="nginx"} AND _time:5m AND error' | wc -l
```

--------------------------------

### Get Unique Sets of Field Values using uniq Pipe

Source: https://docs.victoriametrics.com/victorialogs/logsql-examples/index

Returns unique combinations of values for multiple specified fields (e.g., 'host', 'path') over the last 5 minutes using the 'uniq' pipe.

```LogsQL
_time:5m | uniq by (host, path)
```

--------------------------------

### Build vlagent from Source with Make

Source: https://docs.victoriametrics.com/victorialogs/vlagent/index

These commands demonstrate how to build the vlagent binary from the VictoriaLogs source code. It involves cloning the repository, checking out a specific commit if necessary, and then using the 'make' command to compile. Requires Go to be installed.

```shell
git clone https://github.com/VictoriaMetrics/VictoriaLogs
cd VictoriaLogs
git checkout <commit-hash-here>
make vlagent
```

--------------------------------

### Get Unique Field Values using uniq Pipe

Source: https://docs.victoriametrics.com/victorialogs/logsql-examples/index

Returns unique values for a specified field (e.g., 'ip') over the last 5 minutes using the 'uniq' pipe. This is useful for identifying distinct entries.

```LogsQL
_time:5m | uniq by (ip)
```

--------------------------------

### Configure Dropping Fields for Syslog Ingestion

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

Specify fields to be ignored during syslog ingestion. This example drops 'prod_id' and 'msg_id' fields for logs received on TCP port 514. Wildcards can be used to ignore field prefixes.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.ignoreFields.tcp='["prod_id","msg_id"]'
```

--------------------------------

### Limit Query Results with head

Source: https://docs.victoriametrics.com/victorialogs/querying

This example shows how to limit the initial investigation of query results to the first 10 log entries using the `head` command. Piping to `head` causes the query to be automatically canceled once 10 entries are retrieved, conserving resources.

```bash
curl http://localhost:9428/select/logsql/query -d 'query=error' | head -10
```

--------------------------------

### Alerting Rules Configuration

Source: https://docs.victoriametrics.com/victorialogs/vmalert/index

Examples of defining alerting rules for VictoriaLogs using the `vlogs` type, including service log and request monitoring scenarios.

```APIDOC
## Alerting Rules for VictoriaLogs

### Description
Examples of defining alerting and recording rules in YAML format for vmalert, specifically leveraging the `vlogs` rule type for VictoriaLogs.

### Method
N/A (Rule file format)

### Endpoint
N/A

### Parameters
#### Rule File Structure
- **groups** (array) - A list of rule groups.
  - **name** (string) - The name of the rule group.
  - **type** (string) - The type of rules within the group. Use `vlogs` for VictoriaLogs.
  - **interval** (time) - The evaluation interval for the rules in this group (e.g., `5m`).
  - **rules** (array) - A list of individual rules.
    - **alert** (string) - The name of the alert.
    - **expr** (string) - The expression to evaluate. Supports LogsQL syntax when `type` is `vlogs`.
    - **annotations** (object) - Optional annotations for the alert.
      - **description** (string) - A detailed description of the alert, potentially using templating.

### Request Example
```yaml
groups:
  - name: ServiceLog
    type: vlogs
    interval: 5m
    rules:
      - alert: HasErrorLog
        expr: 'env: "prod" AND status:~"error|warn" | stats by (service, kubernetes.pod) count() as errorLog | filter errorLog:>0'
        annotations:
          description: 'Service {{$labels.service}} (pod {{ index $labels "kubernetes.pod" }}) generated {{$labels.errorLog}} error logs in the last 5 minutes'

  - name: ServiceRequest
    type: vlogs
    interval: 5m
    rules:
      - alert: TooManyFailedRequest
        expr: '* | extract "ip=<ip> " | extract "status_code=<code>;" | stats by (ip) count() if (code:~4.*) as failed, count() as total| math failed / total as failed_percentage| filter failed_percentage :> 0.01 | fields ip,failed_percentage'
        annotations:
          description: "Connection from address {{$labels.ip}} has {{$value}}% failed requests in the last 5 minutes"
```

### Response
N/A (Rule file definition)

#### Success Response (N/A)
N/A

#### Response Example
N/A
```

--------------------------------

### Serverless DataDog Plugin VictoriaLogs Endpoint Configuration

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/datadog-agent/index

Sets the VictoriaLogs endpoint for the Serverless DataDog plugin using the LOGS_DD_URL environment variable. This ensures logs are sent to the correct VMAuth proxy address.

```yaml
custom:
  datadog:
    apiKey: "fakekey"                 # Set any key, otherwise plugin fails
provider:
  environment:
    DD_DD_URL: "<vmauth-base-url>/"   # VMAuth endpoint for DataDog
    

```

--------------------------------

### Configure Syslog Timezone in VictoriaLogs

Source: https://docs.victoriametrics.com/victorialogs/data-ingestion/syslog/index

This configuration starts VictoriaLogs to accept Syslog data on TCP port 514 and specifies 'Europe/Berlin' as the timezone for parsing RFC3164 timestamps. This ensures accurate time logging across different regions.

```bash
./victoria-logs -syslog.listenAddr.tcp=:514 -syslog.timezone='Europe/Berlin'

```

--------------------------------

### Enable Live Tailing with vlogscli

Source: https://docs.victoriametrics.com/victorialogs/querying/vlogscli/index

This example demonstrates how to enable live tailing mode in vlogscli by prepending the query with `\tail`. This allows real-time monitoring of newly ingested logs matching the specified criteria.

```bash
;> \tail error;
```