Claude-skill-registry loki-troubleshoot

Help craft efficient Grafana Loki / LogQL queries for debugging logs — with label‑based filtering, narrow time windows, and best‑practice guidance to avoid expensive or overly broad scans.

install

source · Clone the upstream repo

git clone https://github.com/majiayu000/claude-skill-registry

Claude Code · Install into ~/.claude/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/majiayu000/claude-skill-registry "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/data/loki-troubleshoot" ~/.claude/skills/majiayu000-claude-skill-registry-loki-troubleshoot && rm -rf "$T"

manifest: skills/data/loki-troubleshoot/SKILL.md

Loki Troubleshooting & Query‑Builder Skill

What this Skill does

When a user asks you (Claude) for help inspecting logs via Loki — e.g. “find errors in service X”, “search for request_id=abc123”, “show me 500 responses between 2‑3 PM last night” — use this skill to:

Ask clarifying questions if needed (e.g. which service / label context, approx time window, any known label names).
Build a recommended LogQL query that:
- uses low‑cardinality labels (service, env, host, etc.) whenever possible
- confines to a narrow time window (minutes — hours, not days) by default
- uses fast filters (
```
|=
```
  or
```
|!=
```
  ) rather than regex or heavy parsing
- performs JSON/structured parsing only after filtering
Provide human-readable explanations and warnings for expensive queries
Suggest alternative strategies (metrics, recording rules, structured logs)

Best Practices

Prefer stable labels (
```
app
```
,
```
env
```
,
```
namespace
```
,
```
cluster
```
, etc.)
Avoid high-cardinality labels (
```
user_id
```
,
```
request_id
```
, UUIDs)
Always restrict the time window
Use
```
|=
```
before regex or parsing
Provide warnings for:
- No label selector
- Very wide time windows
- JSON parse without pre-filter
- Regex-heavy queries

Example Queries

User Request Resulting LogQL

"Show me all 500 errors in the

orders

service in the last 2 hours."

{app="orders", env="prod"}[2h] |= "500"

"Find logs for request_id

abc123

in staging for

payments

service over past 30 minutes."

{app="payments", env="staging"}[30m] |= "abc123"

Limitations

This skill does not execute queries