Exercise 2: A LogQL Query for "connection refused" in inventory-service — Possible Solution
====================================================================

{job="inventory-service"} |= "connection refused"

Explanation:

{job="inventory-service"} is the label selector -- exactly the
chapter's own {job="checkout-service"} pattern, just pointed at a
different job label value. This part of the query is cheap and
indexed, narrowing the search down to only the log stream belonging
to this one service before anything else happens. |= "connection
refused" is then a line filter, applied only within that
already-narrowed stream -- it scans just the inventory-service logs
for lines containing that exact text, rather than scanning every log
line across the entire system. This two-step shape (narrow by label
first, then filter content within that narrowed set) is the whole
reason Loki stays cheap at scale even though it isn't full-text
indexing every log line the way Elasticsearch would.

WHY THIS WORKS AS AN ANSWER
------------------------------
This builds a correctly structured LogQL query following the
chapter's own label-selector-then-line-filter pattern, and explicitly
names why that two-step structure keeps the query cheap rather than
just producing a working query without explaining the mechanism.