How Misconfigured Loki Regex Pipelines Silently Break Nginx Log Label Queries

Engineers at a client edge cluster discovered that Loki label-based LogQL queries returned zero results even though raw nginx log lines were visible in Grafana Explore. The root cause was a copy-pasted regex built for nginx's default log format that did not match the server's custom log_format directive, causing Promtail to ingest lines without extracting any labels. Go's RE2 engine compounded the issue, as it silently discards unnamed capture groups and does not support backreferences or lookahead patterns that work in PCRE-based tools. The failure mode was largely silent — no config errors were thrown, and Promtail sometimes logged no warnings at all, making the misconfiguration difficult to detect. The recommended fix involves pulling the exact nginx log_format from the server config and validating the regex offline using Promtail's dry-run mode before deploying any pipeline changes.