Dynamic dashboard Query variable label

Grafana Elasticsearch
1

Hi!

I have a dashboard query variable that queries an elasticsearch datasource for a field value - it’s a hostname, to be specific.

I’m using this hostname as a parameter to Text panel that shows netdata dashboards, which I then set to repeat across all values of the variable. IKR?! So cool. :sunglasses:

The documents that the hostnames come from also store a friendly name for each host, so I can get a list of friendly names. I want to have the associated friendly name as the title of each relevant panel.

It’d be great if a variable could actually be a Tuple, where one part is the value and the other the label.
Is this even possible?

2

Yes, I think what you want is possible. Will depend on how you actually query the labels you want to use. See if Filter variables with regex | Grafana Labs maybe works for you?

3

Ok, cool! So at the moment my query looks something like this:

{"find" : "terms" , "field" : "node.public_hostname"}

I suppose I need to bring back multiple fields…?
eg:

{"find" : "terms" , "fields" : ["node.public_hostname", "node.name"]}

or similar?

Not sure how to do this.

4

I tried creating another variable that hung off the first one, like so:

{"find" : "terms" , "field" : "node.name", "query": "node.public_hostname:$Nodes"}

Which works for the first panel, but doesn’t repeat correctly - subsequent panels just show the first one back:

image
image2752×954 238 KB

5

The only way I can see it working so far is to concatenate both values into a single field and then split it out using regex. Is that right?

6

I created a new field with the node.public_hostname and node.name concatenated. I then set a regex on the Variable that targeted this field to be:

/(?<text>.*):(?<value>.*)/

and I set the panel title as: ${Nodes.__text} but when I select multiple items it just concatenates all the selected variables in all the panel titles rather than repeating the panel and each title having its own correct value. :frowning:

7

Ok, I think something had cached in my dashboard from last time. I changed the panel title back to ${Nodes} and it all worked as it should.

8

Cool, glad you got it! And it’s great that you’ve shared your approach so that others in the same boat can hopefully pick it up too. I unfortunately have zero experience with elasticsearch, so would not have been able to contribute anything very meaningful here apart from point you to the regex :).

FWIW, with some other query languages (SQL, GraphQL) there are actually ways to select the “text” and “value” fields separately, without needing to use regex to split a single set of query results. But again, not sure how that plays out with ES.

9

Hello

i have the same problem and can you explain me how you do to concat both value un a single field in grafana template ?

this query : {“find” : “terms” , “fields” : [“node.public_hostname”, “node.name”]} doesn’t work !

Tanks a lot for you help.

regards

10

I didn’t get it to work either. In the end I adjusted our beats config to send up an additional pre-concatenated field.

Actually, we’ve since moved away from Grafana. I wanted it for multi-cluster monitoring but it didn’t really work well.
I ended up writing this instead: https://github.com/ndtreviv/elastic-stack-monitoring

11

Is this also possible for Alert messages?
I exactly followed your description, created a variable in the dashboard section with the desired value from elasticsearch data source.

Then I added the $param to the Custom Labels section, but won’t work. I assume, the Alerting section doesn’t use same variables as the Dashboards section?

How can I specify a variable in Alerting and fill the variable with a elasticsearch query?