How to Capture Time and Reponse Time from access logs and convert into alert

Grafana Loki
,
1

Hello Grafana Experts,

I have below log line which I have ingested in Grafana loki and now I want to extract the timestamp and ResponseTime from this log line.

Log Query : {domain=“dev1”, env=“dev”, job=“access-logs”} |~ SNCalculateQuoteSalesTaxServiceV2 | regexp (?P<timeStamp>(?P<date>\S+\s[0-9]+:[0-9]+):[0-9]+)\s(?P<responseTime>\S+)\s(?P<httpMethod>\S+)\s(?P<ecid>\S+)\s\S+\s(?P<uri>\S+)\s(?P<httpResponse>\S+)\s\S+

My goal is to create Time series using timestamp and responseTime and create an alert if responseTime is greater than 1secs.

It would be appreciate if can help me on this

2

You don’t need timestamp, your ruler should naturally be processing your queries for the past however minutes specified.

Try this (not tested)

max(
  max_over_time(
    {domain="dev1", env="dev", job="access-logs"}
      |~ SNCalculateQuoteSalesTaxServiceV2
      | regexp `(?P<timeStamp>(?P<date>\S+\s[0-9]+:[0-9]+):[0-9]+)\s(?P<responseTime>\S+)\s(?P<httpMethod>\S+)\s(?P<ecid>\S+)\s\S+\s(?P<uri>\S+)\s(?P<httpResponse>\S+)\s\S+`
      | unwrap responseTime
      | __error__=""
    [5m]
  )
)