Aggregate readbackCheck the query before the delivery.
A production dashboard did not show the expected logs. The investigation compared its selector with repository configuration, the collector revision actually deployed and aggregate ingestion at the destination.
The collector and the query disagreed.
The production collector was deployed from before the label-promotion change. Development included it. The dashboard expected the newer label shape.
| Returned partition | Estimated bytes |
|---|---|
| Environment-labelled / development | 41,715,481 |
| Without an environment label | 21,228,383 |
These are two disjoint selectors in the same window, not log-entry counts. Observed ingestion and the deployed configuration supported a label/query mismatch.
Which sources supported the diagnosis?
Authenticated Grafana/Loki index-volume results, Railway deployment/configuration readback and immutable repository revisions. Only aggregate values, label shapes and deployment/configuration metadata were inspected.
The readback did not change the collector, dashboard, variables or deployment.
The diagnosis did not deploy the fix.
A normal application deployment would not update the collector. The next task needed a collector-specific revision, rollback target, authorization and destination readback.
This investigation changed no collector, dashboard, variable or deployment. Retention, alert operations and broader logging requirements remained separate.