Display subset of data based on string pattern on template variable dropdown in table panel

Grafana Version: 6.2.5
Elastic search
I have logs data with pattern ERR,INFO,DEBUG
Example “data_ERR_notconnected”, “sys_INFO_connected”, “sys_DEBUG_network”
I am trying to create template variable for ‘marker’ with variable dropdown as ERR,INFO,DEBUG. So when ERR is clicked from dropdown only error based data is displayed in table format panel.
Screenshot%20(38)

I am using regex as /.*(ERR|INFO|SH)/ but i dont see any change in response. Any idea would be helpful? @torkel @tiagocruz @daniellee @mefraimsson

Hello swathimuppalla,

Here some example:

ES Query usage example:

clientInfo.customerId:$customerId 

Variables:

image

Hope this helps you somehow!

Hi @tiagocruz Thank you for your response. The custom variable you created have limited values which would work. But the data i have is huge and i have index name marker with all the data.
In Custom all value you have given a range of [0 to 50000]. How do I give a range for string like [ERROR]?

Not sure I understand what you need help with. Is it the query where you’re trying to use the selected template variable or is it the regex?

Template variable “marker” will get the values which consists of different logs… example “data_ERR_notconnected”, “sys_INFO_connected”, “sys_DEBUG_network”. I am trying do changes in regex of variable “marker” so that “ERR” will display only error related logs and INFO will display only info related logs in panel etc…

Your screenshot of the variable drop down looks correct to me so I guess you’re having problems using that variable in your query. Can you show a screenshot of your query your using and possibly a dump of the query inspector output to understand where things go wrong?


@mefraimsson

Here in dropdown i have selected INFO. But i get error based logs too.
I am trying to get Version based data grouping by marker.keyword.

@swathimuppalla in your query where you have an existing lucene query version.keyword:$version you probably need to filter by marker.keyword as well. For example version.keyword:$version AND marker.keyword:$marker.

@mefraimsson Thanks for the response. I tried the query version.keyword:$version AND marker.keyword:$marker . It displays No data to show for every version i choose its the same result.

The situation here is when i give regex **/.*[_ERR_|_INFO_|_SH_]/**. I get preview of all values.

When i give regex /.*(_ERR_|_INFO_|_SH_)/ i get preview as

Basically i am not able to group a values based on string pattern in a template variable? Is there anyway i could group the values based on string pattern?

@mefraimsson I have tried all kind of regex such as
/.*[Err: _ERR_|Info: _INFO_|Sh: _SH_| Warn: _WARN_| Error: _ERROR_].*/ and tried using tags too. But tags query too displays all kind of markers. Any solution would be helpful for my project?