CPU/RAM overload due to query with regexp and metadata

[ddday999]

Hello, dears!
Please, help me to understand the strange behaviour of Loki.

Describe the bug
Small query with construction <regexp + metadata + regexp> in Grafana Explore overloads RAM and CPU await
{application="app"} !~ "(?i)info" | filename = "E:/app/app.log" |~ "(?i)err"

RAM:

CPU:

But, occured that constructions below:

1. {application="app"} !~ "(?i)info"
2. {application="app"} !~ "(?i)info" |~ "(?i)err"
3. {application="app"} !~ "(?i)info" |~ "(?i)err" | filename = "E:/app/app.log"
4. {application="app"} | filename = "E:/app/app.log" !~ "(?i)info" |~ "(?i)err"

works properly - without any overloads by RAM/CPU

Only construction <regexp + metadata + regexp> triggers this problem.

In addition, in scanario below didnt stops the overload:
Cancellation of query (by timeout or manually) in Grafana, then OOM kill of Loki container - its restarting with and overloading again

Helps only manual restart of Loki container

To Reproduce
Steps to reproduce the behavior:

1. Started Loki
2. Started Grafana
3. Started S3 - MinIO
4. Query: {application="app"} !~ "(?i)info" | filename = "E:/app/app.log" |~ "(?i)err"

Expected behavior
Overload by RAM/CPU await

Environment:

1. Monolithic Loki deployment (in cluster of 3 nodes: 8 CPU/12G RAM, 4G Swap)
2. Running in container (every Loki container limited by 6 CPU/10G RAM, 4G Swap)
3. Logs stores in MinIO S3