Splitting a string into parts, converting to a number and then doing maths or comparisons

Grafana Dashboards
1

  • What Grafana version and what operating system are you using?
    Enterprise 12.0.3

  • What are you trying to achieve?
    extract numbers from strings and do maths

Hello,

We scan our github workflow logs for the string that tells us what version runner was used, e.g. 2.320.0 and send these as loki logs, which we can then extract with a query string. We then have a dashboard panel which shows us the repository and runner version.

Some of our runners are out of date and I wish to detect this and highlight it in our dashboards

I wish to split the version and compare it with a baseline version, so e.g. 2.319.0 or earlier would get flagged. I guess if I could transform a.bcd.e into an integrer abcde then I could do some maths.

I can see a transformation to split a string, but can’t see a way to do the above by splitting and recombining bits of the string, you can only extract a substring once.

thanks for any ideas.

2

Hi, you could use [Extract fields transformation]( Transform data | Grafana documentation ) with Regexp parser. It allows you to extract multiple groups and name them with capture groups, so the regex could look like /(?<major>.*?)\\.(?<minor>.*?)\\.(?<patch>.*)/ which would give you three columns (I’m not sure bout the \\. part though, never tested that but should work). Then you could use two times Add field from calculation, where you’d use string concatenation to get the version string you want, then Convert Field type to make it a number.

You probably could also do that with your datasource - is it Loki?

3

thanks for those ideas, I will have a play. Yes, the DS is loki.

4

So you could either do it like that (with the transformation) or with label_replace function to do that on loki side (before the data is returned to Grafana), although I think the transformation will be easier in this case, as you’d require three label_replace calls to do that.

5

can you please post (obfuscated but structure intact) sample log line you scrape with alloy? and your alloy config?

I am not a fan of transformations personally, I like to do it on ingest or on datasource if at all possible

6 
{"repo_url": "https://github.com/someorg/somerepo", "runner_name": "somerunner", "runner_versions": ["2.320.0"]}

above is a typical line logged into Loki.
on rare occasions if we’re updating runners, the array of runner versions might contain two items, but I don’t want to worry about that for now!

7

this is not being scraped by grafana agent or alloy, we have a scanning program that uses the github API to scan orgs and repositories and workflows then looks at recent workflow logs to extract the string containing the runner version.

I would ask if I could release the script as open source but I’ve never been able to get permission for this sort of thing before.

This does mean that I am completely free to change the format of the log message to be anything else I want. However, the usage of the runner version logs and their dashboards are often used by people I have no direct connection with, so I can’t just change them just any time.

8

So how are you pushing stuff to Loki? I am confused

9 
/(?<major>.*?)\.(?<minor>.*?)\.(?<patch>.*)/

with a small tweak, that worked for splitting into parts, thanks @dawiddebowski

10

it’s very easy to send log messages to loki using curl, or in python use this: