Loki LogQL topk aggregate function

Question

I've started shipping traefik access logs (in JSON) to Grafana Loki and wanted to visualize the top 3 ClientHosts. This is the LogQL I have written for this but it returns all ClientHosts for the selected time range instead of only the top 3. What am I missing?

topk(3, sum by (ClientHost)(count_over_time({filename="/var/log/traefik/access-json.log"}|json[5m])))

Answer 1

Are you using the "Explore" on Grafana? Do not forget to select the following option:

Query type = Instant