{
  "id": 2325716,
  "title": "Fixing Loki Regex Pipeline Stage Failures on Nginx Logs",
  "url": "https://urgent.news/2026/08/21/fixing-loki-regex-pipeline-stage-failures-on-nginx-logs",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-21T07:01:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/oleksandr_kuryzhev_42873f/fixing-loki-regex-pipeline-stage-failures-on-nginx-logs-2741"
  },
  "original_language": "en",
  "account": "When Loki’s regex pipeline stage fails on Nginx logs, it can cause zero results for certain label queries and empty panels in Grafana Explore. This issue often arises when a regex is copied from a tutorial that assumes a standard Nginx log format, but the actual log format differs. The regex may compile, but it will fail to match the real log lines due to inconsistencies. Key problems include mismatches in field order, extra fields, quoting issues, and the use of Go/RE2-specific regex features like greediness and named capture groups. Symptoms include empty field panels, no errors in logs, and later spikes in ingester memory usage and rate limit errors due to cardinality explosion. The root cause is typically a regex that doesn’t accurately reflect the actual log format. To fix the issue, first align the regex with the actual Nginx log_format defined in /etc/nginx/nginx.conf. Use Promtail’s dry-run mode with a real log sample to validate the regex. Next, ensure the pipeline stages are ordered correctly, with labels added after the regex stage so that the extracted data can be referenced. Set the timestamp using the real $time_local field from the log format to ensure accurate time-range correlation. Finally, move high-cardinality fields like remote_addr and user_agent to the structured_metadata stage instead of labels to prevent cardinality explosion and keep your ingesters from OOMing. This structured approach ensures that your Loki deployment remains stable and efficient.",
  "summary": "Originally published on kuryzhev.cloud Your Loki dashboard shows the raw nginx access log fine — but every label query returns zero results, and nobody notices until the ingesters start OOMing. We hit this exact scenario on a client's edge cluster: {job=\"nginx\"} |= \"500\" in Grafana Explore returned every 500 error you'd expect, but {job=\"nginx\", status=\"500\"} came back empty. That gap — raw text…",
  "key_points": [
    "Loki’s regex pipeline stage fails on Nginx logs, causing zero results for label queries",
    "Issue often arises from regex mismatches due to log format inconsistencies",
    "Fix by aligning regex with actual Nginx logformat and optimizing pipeline stages"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}