I have a query variable name “Instances” that is extracting a list of instance ids from my Fargate stack. I use this in ElasticSearch index searches and it works great for that purpose.
I have two datasources for logs. One index is created using the Serilog format (app metrics) and the other are metrics generated by a MetricBeat sidecar (for systemic metrics) The problem is, the datasources use a different format to represent the IP address(but very similar).
For example:
MetricBeats datasource ip address format (hostname): ip-10-119-28-254.us-west-2.compute.internal
Application Metrics “MachineName” (from Seriolog): ip-10-119-28-254
Here’s the problem:
My “Instances” variable, based on the MetricBeat index, will return a list of all the available Fargate task IP addresses, like this:
ip-10-119-28-254.us-west-2.compute.internal
ip-10-119-28-254.us-west-2.compute.internal
ip-10-119-28-254.us-west-2.compute.internal
ip-10-119-28-254.us-west-2.compute.internal
I’d like to create another variable (ideally) that would create a “stripped down” version of the list like this:
10-119-28-254
10-119-28-254
10-119-28-254
10-119-28-254
What I’m Trying to Do Now:
Create another query variable called “AppInstances” that is essentially a copy of the “Instances” query variable, but would include a Regex to extract only the “ip-”+the ip address itself. This “instance” variable will be exposed to the user and they can select one or more of the IP addresses from a drop down list. When they do, I’d like the stripped down variable to refreshed as well. Then I can use either the instances variable for some queries and use the stripped down variable for others, depending on the datasource my panel query is using.
In this way, when I execute an ElasticSearch query for a MetricBeat datasource I can use:
… AND host.hostname:$Instances
And for the Application metrics datasource, I’d use:
… AND fields.MachineName:$AppInstances
What I’ve tried:
I have tried creating a copy of the instance variable and then in the Regex field I’ve entered this formula: ip-\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}
That doesn’t throw an error, but doesn’t return anything either. So, essentially, I’m trying to get the Regex to work that will strip out the “.us-west-2.compute.internal” and return the IP address that will work for the App Metrics query variables.
I appreciate any help/guidance you can provide.