Difference between Raw logs and Range

[Heyzi]

victorialogs-datasource: v0.13.2
victorialogs: v1.4.0
I want to plot the number of errors at each point in time, but I get strange results in the Raw logs and Range.
If this is correct behavior, where is the difference described?
What query should I write to make the graph look more like the Raw logs graph?

[tiny-pangolin]

You can make the timeseries panel more like the logs volume panel, changing the graph style to bar under Graph styles when you are editing the panel
I believe the logs volume panel in explore doesn't use a normal panel that, and it is not exposed to the user for making their own panels.

[leshcat]

Have similar question, how do you use time range/instant types?
Are there any examples or documentation related to actual usage of those handlers?

I am currently trying to convert Loki PromQL:
sum(count_over_time({env="dev", container="myapp"} |= '[ERROR]' [1h])) by (env, container)

which gives following graph:

to a VLogs query and get similar graph.

VLogs query i came up is:
_time:1h {container="myapp", env="dev"} "[ERROR]" | stats count()

but it only works correctly on Instant type and only as a dot:

[tiny-pangolin]

this can be solved by adding by(_time:5m) in the query which will give you give you the count in an hour window so the whole query would be _time:1h {container="myapp", env="dev"} "[ERROR]" | stats by (_time:5m) count()

[leshcat]

Hello, @tiny-pangolin ,

Thanks for reply!

It renders better indeed, but still not the same representation as Loki does.

Type: Range, 6h overview:

Loki:

vLogs:

Total number matches. Perhaps i need to do something with the panel instead?

[tiny-pangolin]

try remove ing _time:1h from the start of your victorialogs query, and change the by(_time:5m) to by(_time:1h) and see if that works. _time:1h is limiting the response to messages sent in the past hour instead of getting the duration from Grafana and the _time in the by should match the duration for count_over_time in your loki query

[leshcat]

try remove ing _time:1h from the start of your victorialogs query, and change the by(_time:5m) to by(_time:1h) and see if that works. _time:1h is limiting the response to messages sent in the past hour instead of getting the duration from Grafana and the _time in the by should match the duration for count_over_time in your loki query

Makes sense, but unfortunately that didn't do the trick and values are now weird:

[dmitryk-dk]

Hi @Heyzi , @leshcat ! Can you check the issue on the latest version of the victorialogs. Is it reproducible?

[tommy-ng0]

still happening on the latest version of VictoriaLogs (victoriametrics/victoria-logs:v1.17.0-victorialogs) by the look of it

[mfcmaestro]

It would be nice if the graph visualization will be improved and will looks similar to the loki one.
Currently the stat visualization with background graph is not much useful in Grafana.