Weird LogQL behavior when aggregating logs

Question

We collect .NET logs to Grafana Loki, I want to create an alert for errors.

If I use query count_over_time({app="myapp"}[1m]), I see a nice curve on the graph.

However, if I add filtering count_over_time({app="myapp-portal"} | json | Level="Error" [1m]),

I get multiple one-point series. Can anybody explain why it does not do proper grouping in the latter case?

Answer 1

I don't know why it works like that (is it a feature or a bug?), but you can solve this issue by adding a "sum" at the LogQL beginning:

sum(count_over_time({app="myapp-portal"} | json | Level="Error" [1m]))