Expand top categories for string

Grafana Loki
,
1

Hello everyone!
I run loki 3.3.0 and Grafana 11.3.1. My goal is to draw diagram with top 10 categories during last hour.
I use following query to select interesting messages:

{service=mail, env=“$sel_env”} |= “dropping the email” | json | line_format “{{ .date_time}} {{ .reason}}”

I want to build a dashboard based on a field reason that displays the frequency of occurrence of a particular cause in error messages during last hour.
This field contains only 1 word and there is a limited number of options ( ~7).
I try to use following:

sum by(instance) (count_over_time({service=mail, env=“$sel_env”} |= “dropping the email” | json | reason!=“” | error=“” | unwrap reason [1h]))

But unwrap works only with integers. How to apply the same to the string (reason field)?

2

You said you want to aggregate based on reason, yes? If so, try this:

sum by(reason) (
  count_over_time({service=mail, env="$sel_env"}
    |= "dropping the email"
    | json
    | reason!=""
    | error="" [1h]
  )
)
1 Like
3

Sometimes you poke at a problem and don’t see a solution. Thanks, that’s exactly what I needed.