Grafana dashboard variable regexp in variable

Grafana Dashboards
1
  • What Grafana version and what operating system are you using?
    Ubuntu server 24.04, Grafana grafana version 11.3.0+security-01
  • What are you trying to achieve?
    I want to cut part of path to log file.
/nginx_log/access.log
/nginx_log/error.log
/site_logs/laravel.log
  • How are you trying to achieve it?
    I tried any regexp in grafana dashboard variable.
  • What happened?
    I can’t receive only filename in path string
  • What did you expect to happen?
    I want receive if it possible only filename
access.log
error.log
laravel.log
  • Can you copy/paste the configuration(s) that you are having problems with?
{
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": 14,
  "links": [],
  "panels": [
    {
      "datasource": {
        "type": "loki",
        "uid": "ae3uqu262e96od"
      },
      "fieldConfig": {
        "defaults": {},
        "overrides": []
      },
      "gridPos": {
        "h": 17,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 1,
      "options": {
        "dedupStrategy": "none",
        "enableLogDetails": true,
        "prettifyLogMessage": true,
        "showCommonLabels": false,
        "showLabels": false,
        "showTime": true,
        "sortOrder": "Ascending",
        "wrapLogMessage": true
      },
      "pluginVersion": "11.3.0+security-01",
      "targets": [
        {
          "datasource": {
            "type": "loki",
            "uid": "ae3uqu262e96od"
          },
          "editorMode": "builder",
          "expr": "{host=\"dev\", filename=\"$file\"} |~ `(?i)$find`",
          "queryType": "range",
          "refId": "A"
        }
      ],
      "title": "Frontend BETA",
      "type": "logs"
    }
  ],
  "preload": false,
  "schemaVersion": 40,
  "tags": [],
  "templating": {
    "list": [
      {
        "current": {
          "text": "/site_logs/laravel.log",
          "value": "/site_logs/laravel.log"
        },
        "datasource": {
          "type": "loki",
          "uid": "ae3uqu262e96od"
        },
        "definition": "",
        "label": "File",
        "name": "file",
        "options": [],
        "query": {
          "label": "filename",
          "refId": "LokiVariableQueryEditor-VariableQuery",
          "stream": "",
          "type": 1
        },
        "refresh": 1,
        "regex": "",
        "type": "query"
      },
      {
        "current": {
          "text": "",
          "value": ""
        },
        "description": "",
        "label": "Find text",
        "name": "find",
        "options": [
          {
            "selected": true,
            "text": "",
            "value": ""
          }
        ],
        "query": "",
        "type": "textbox"
      }
    ]
  },
  "time": {
    "from": "now-3h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "browser",
  "title": "DEV Frontend",
  "uid": "fe3uum3g6bgu89",
  "version": 7,
  "weekStart": ""
}
  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.
    No.
  • Did you follow any online instructions? If so, what is the URL?
    Add variables | Grafana documentation
    and other regexp tools.

Is it possible?

2

image
image737×908 71.3 KB

3

Sorry. But where are you did it? I don’t see that options in logs

image
image1621×972 147 KB

4

what is your data source?

5

When creating the variable type such a regex into the Regex field:
/.*\/(.*)/
What it would do is to match everything up to last / sign and return everything after it (the file name). Notice that the first .* isn’t in parentheses! Grafana treats frist catching group as the text of the variable and the second catching group as value, which is probably not something you want.

1 Like
6

I tried. Preview looks good. But when i come back to dashboard i have “no data”(((

image
image727×841 46.1 KB

image
image1638×773 13.3 KB

7

Ok, can you check in Query Inspector what is being sent to Loki? Maybe there you’ll find an answer. Also - what are the values of your file label? Cause in the recent screenshots you had data when file label was set to the full path, now you only have the file name, not the full path. Maybe that’s an issue?

1 Like
8

“filename” and “host” lables i used.

9

“filename” and “host” lables i used.
It’s my promtail config. If it help.
Maybe i misunderstand about regex in grafana and i can’t cut of part of path?

scrape_configs:
  - job_name: frontend-dev
    pipeline_stages:
    static_configs:
    - targets:
      - localhost
      labels:
        host: dev
        __path__: /site_logs/*.log

    - targets:
        - localhost
      labels:
        host: dev
        __path__: /nginx_log/*.log

image
image1081×461 83.2 KB

10

Ok, so from the explore screen it seems that you need to pass the entire path to the file, not just the file name (possible values for the filename selector are the full path). Remind me - why did you want to strip the path and leave only the file name - readability?

1 Like
11

Yes, i want do it only for readability.

12

According to docs it should be possible but unfortunately I didn’t find a way to do so on Prometheus label values :confused:

1 Like
13

I use promtail > loki > grafana.
Thanks for your help! I leave that idea, developers use that logs without problem. It was more for interest and practice.

1 Like