How to get the number of entries in a log according to one word obtained from a regexp

Grafana Loki
,
1

Hi, I’m new using grafana/loki.
I have a doubt regarding how to obtain some data from the log and showing it in a Grafana dashboard. I’ll try to explain what I want to obtain.
I’ve made the integration between Loki and Grafana. I can see in Grafana the data from the log.
But now, I want to obtain the total number of entries exist according to different words (obtained from a regexp I have to create).

An extract of the log:
ERROR|2023-04-17 15:18:47,272|8C4BBEA0F666443CBD2DF7BFBF12DCD1|josem.lopez.moreno.ext|TechnicalIncidentRestController|TechnicalIncidentRestController: getActuationGroupCoordinatorUserListMassive Exception: Usted no tiene privilegio de coordinación para el grupo N3 SUR Intervención General.
ERROR|2023-04-17 17:08:12,379|8B852E846260444F8BFECEAC56A2B314|josem.lopez.moreno.ext|GestorResourceBundle|Error al leer archivo de propiedades trewa.conf.trewaconf Excepción: java.util.MissingResourceException: Can’t find bundle for base name trewa.conf.trewaconf, locale es_ES
ERROR|2023-04-17 17:09:59,029|8AB2CD94BD7146799860E32C1EFD193C||UserServiceImpl|UserServiceImpl: userLoginLDAP: usuario o contraseña incorrectos en LDAP.

Explaining it with the first line:
ERROR|2023-04-17 15:18:47,272|8C4BBEA0F666443CBD2DF7BFBF12DCD1|josem.lopez.moreno.ext|TechnicalIncidentRestController|TechnicalIncidentRestController: getActuationGroupCoordinatorUserListMassive Exception: Usted no tiene privilegio de coordinación para el grupo N3 SUR Intervención General.

user ID: osem.lopez.moreno.ext (field 4)
transaction web ID: 8C4BBEA0F666443CBD2DF7BFBF12DCD1 (field 3)
java class name: TechnicalIncidentRestController (field 5)

I want to obtain only errors log. This filter is done.
From all the java classes (field 5) that appear with error, get the user ID, transaction web ID.
But I want to obtain this dinamicaly not making the filter manually in the dashboard one per onne java class. (obtain this value with a regexp)
Is this possible to configure? Would you please indicate me how to do it?

2

I don’t think there is an easy way to dynamically apply filter based on condition. Ideally you should want to make sure your java logs are generated in roughly the same format.

Would also help if you can post the filter you are currently using for different classes.

3

To obtain the number of entries for UserServiceImpl: sum(count_over_time({service=“NAOS_V3”, job=“catalina”, filename=“/opt/apache-tomcat-9.0.41/logs/catalina.out”} |=ERROR |=UserServiceImpl [$__interval]))

To obtain the number of TechnicalIncidentRestController
sum(count_over_time({service=“NAOS_V3”, job=“catalina”, filename=“/opt/apache-tomcat-9.0.41/logs/catalina.out”} |= ERROR |= TechnicalIncidentRestController [$__interval]))

4

You can try something like this:

{SELECTOR} | pattern "<_>|<_>|<_>|<_>|<_>|<ITEM>:<_>"

And then:

sum by (ITEM) (count_over_time(
  {SELECTOR} | pattern "<_>|<_>|<_>|<_>|<_>|<ITEM>:<_>"
  [$__interval]
))

LogQL Analyzer | Grafana Loki documentation.

5

OK! Thank you so much for your help