Query result used in another query

[kuburoman]

Hi,
i would like to extract so id using pattern and then use found value for another query.

Example, i have log:

2023-08-23 12:35:22,981 (user1) have id: 1233222 

Now i would like to put (user1) as variable and in dashboard it would show me all logs containing id (1233222). These logs don’t have (user1) again only id. Is it possible? The only way I could think of is to use a data link and click through to another dashboard. Is it possible to have it on one dashboard?

Thanks

[clevernessisamyth]

Hello,

Have you tried when capturing the first log’s files to get the user id as label? And then create Grafana variable that lists the label values?

[kuburoman]

If i would create label from this ID value and save it, i would get really High Cardinality. It needs to be done “on fly”.

[clevernessisamyth]

Can you show us an example of a log line from the 2nd query? And what you want to get from it?

[kuburoman]

2023-08-23 12:35:22,981 (1233222) lorem ipsum

And just show this log. Nothing more.

[clevernessisamyth]

You can’t use labels/variables from a query in another query.

I tried something that seems to work:

• Add a “text box” variable with a default variable set to “.+”:

• Use “pattern” to capture the username and ID from the first query, and the ID from the second query. And use the user variable and the “line_format” in the first query.

• Now in the Transform section do these transformations:

1. Merge the results of the 2 queries.
2. Extract the ID label to a field.
3. Group the rows by time and the ID field, and get “All the unique” values of the column “Line” which is the log message.
4. Extract the “ID” (0) and the “log” (1) message from the field “Line”. Set Aliases, Replace all fields and Keep time.
5. Filter the “Log” column and exclude all lines that has the value “Not Found”

• Choose the visualization “Logs”.

• Test a username.