Extract min and quartiles from numeric field

[aaron7f9d]

I have a set of logs that have the following shape:

{
  delta: number
  time: 'yyyy-mm-ddThh:mm:ss'
  records: number
  msg='target message'
}

This comes from a job that runs for some amount of time every hour.

So far I have min (rate({container_name="name"} |= target message | json delta="delta" [15m])) which returns a values but does not seem to be correct (and is the same for every period). Using min by() groups on delta which is not desirable.

Ideally, I would like this to group by hour (the actual hour, not a rolling period of time) and show min, 5%, 10%, 25%.

Is there a way to extract the YYYY-MM-DDTHH portion of the startTime key and group on that?

Any other suggestions are greatly appreciated, thanks

[tonyswumac]

If you really want to you can do something a bit janky like this:

| json | label_format yyyy=`{{ substr 0 4 .time }}`,mm=`{{ substr 5 7 .time }}`

Some actual samples and a concrete example of what you are looking for would help.

[aaron7f9d]

thanks, that label_format is very helpful. Where is the best place to find documentation on label_format and string manipulation functions? Searching for grafana label_format points me to Template functions but that doesn’t seem like a very good resource.

sample log

{
  …
  "delta": 79210,
  "time": "2024-03-14T01:55:55.007Z",
  "records": 49,
  "msg": "target message"
}

The delta value is a time diff in milliseconds of when a record is created in a 3rd party service and when we process it.

running min by(hour) (rate({container_name="name"} |= target message | json delta="delta", time="time" | label_format hour={{ substr 0 13 .time }} [60m]))

creates a graph with a solid line as

follow up question: how do we display the {hour="2024-03-14T01"} label as just 2024-03-14T01?

[tonyswumac]

1. LogQL documentation: LogQL: Log query language | Grafana Loki documentation

2. You can change legend display from query option: