How to subtract values of two labels from the same log line and apply range function

Grafana Loki
,
1

Hi, I have an access log line that contains a couple of timers. I can run a range function (max_over_time) over an individual label and graph the results. Is it possible to apply a range function over a calculated value of two labels?

The example below would graph max_over_time for the Tc timer.
`

max_over_time({component=“$component”, datacenter=“$datacenter”, path=“/var/log/haproxy.log”, environment=“production”} |= $line_filter_1 | regexp (?P<date_time>\w+\s+\d+ \S+) (?P<bil>\S+) rbid-(?P<rbid>\d+)\[(?P<pid>\d+)\]: (?P<client_ip>\S+):(?P<client_port>\d+) \[(?P<request_date>\S+)\] (?P<frontend>\S+) (?P<backend>\S+)/(?P<server>\S+) (?P<Tw>\d+)/(?P<Tc>\d+)/(?P<Tt>\d+) (?P<bytes_read>\S+) (?P<termination_state>\S+) (?P<actconn>\d+)/(?P<feconn>\d+)/(?P<beconn>\d+)/(?P<srv_conn>\d+)/(?P<retries>\d+) (?P<srv_queue>\d+)/(?P<backend_queue>\d+) | unwrap Tc [$__auto])

`

How would the query look like in case of max_over_time for (Tc - Tw)

Thank you!

2

Ok, I think I have found a solution, now asking if there is a more efficient way.

`

max_over_time({component=“$component”, datacenter=“$datacenter”, path=“/var/log/haproxy.log”, environment=“production”} |= $line_filter_1 | regexp (?P<date_time>\w+\s+\d+ \S+) (?P<bil>\S+) rbid-(?P<rbid>\d+)\[(?P<pid>\d+)\]: (?P<client_ip>\S+):(?P<client_port>\d+) \[(?P<request_date>\S+)\] (?P<frontend>\S+) (?P<backend>\S+)/(?P<server>\S+) (?P<Tw>\d+)/(?P<Tc>\d+)/(?P<Tt>\d+) (?P<bytes_read>\S+) (?P<termination_state>\S+) (?P<actconn>\d+)/(?P<feconn>\d+)/(?P<beconn>\d+)/(?P<srv_conn>\d+)/(?P<retries>\d+) (?P<srv_queue>\d+)/(?P<backend_queue>\d+) | line_format product={{sub .Tt .Tc}} | logfmt | unwrap product [$__auto]) by (bil, rbid))

`