Skip to content

feat: improve Loki defaults, add org-id support, and fix install docs#25

Merged
noexecstack merged 2 commits intomainfrom
feat/loki-defaults-and-org-id
Mar 31, 2026
Merged

feat: improve Loki defaults, add org-id support, and fix install docs#25
noexecstack merged 2 commits intomainfrom
feat/loki-defaults-and-org-id

Conversation

@noexecstack
Copy link
Copy Markdown
Owner

Summary

  • Change default LogQL query from {app="hubble"} to {container="cilium-agent"} to match the standard Cilium agent container label
  • Add --loki-org-id flag to send X-Scope-OrgID header for multi-tenant Loki deployments (auth_enabled=true)
  • Reduce default Loki batch limit from 5000 to 1000 for reliability
  • Increase Loki HTTP timeout from 30s to 120s for large queries
  • Silently skip non-JSON log lines instead of warning (cilium agent logs contain mixed content)
  • Unwrap {"flow": {...}} envelope from Hubble dynamic exports via the Cilium configmap (hubble.export.*)
  • Fix README install instructions to use git+https instead of pip install from PyPI (package is not published)
  • Update README flag reference with new defaults and --loki-org-id

Test plan

  • All 134 existing tests pass
  • Verify Loki queries work with the new default query selector
  • Test --loki-org-id with a multi-tenant Loki instance
  • Confirm flow envelope unwrapping works with dynamic exports

- Change default LogQL query to {container="cilium-agent"} which matches
  the standard Cilium agent container label
- Add --loki-org-id flag to send X-Scope-OrgID header for multi-tenant
  Loki deployments (auth_enabled=true)
- Reduce default Loki batch limit from 5000 to 1000 for reliability
- Increase Loki HTTP timeout from 30s to 120s for large queries
- Silently skip non-JSON log lines instead of warning (cilium agent logs
  contain mixed content)
- Unwrap {"flow": {...}} envelope from Hubble dynamic exports via the
  Cilium configmap (hubble.export.*)
- Fix README install instructions to use git+https instead of PyPI
  (package is not published to PyPI)
- Update README flag reference with new defaults and --loki-org-id
@noexecstack noexecstack merged commit 9e66e42 into main Mar 31, 2026
5 checks passed
@noexecstack noexecstack deleted the feat/loki-defaults-and-org-id branch March 31, 2026 16:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant