In the log analysis, select instant query and choose the Loki data source to query logs.

Scenario 1: Query each log line with a 401 status {container="evaluate-loki-flog-1"} | json | status="401"

Scenario 2: Query the number of logs with a 401 status code in the last 5 minutes count_over_time({container="evaluate-loki-flog-1"} |= "401" [5m])

Scenario 3: Calculate the number of logs per second where the JSON field status is 404 sum by(container) (rate({container="evaluate-loki-flog-1"} | json | status=404 [1m]))