Using parsed log fields in template variables

[bluebatgames]

I have logs with the following labels and fields (parsed by fluentbit parser):

Is there any way to use the value of the ‘level’ field in a Grafana template variable? So far I haven’t found a way to do it.

Thanks,
Guy

[felixte]

Did you ever find a way to do this? I can’t get a variable to use anything but a hard label as sent in the stream (not extracted or detected fields).

[dror1212]

Didn’t find a way wither, currently using regex to extract (take everything after level= untill the space). something like:
regexp “.level=(?P[^ ]).*$”

[felixte]

I can’t seem to get REGEX to work either. I’ve validated the REGEX at regex101.com I assume that should work. I put in a feature discussion post here that captures the PATTERN based extraction.

[dror1212]

can you send the regex you used? you need to add the P and everything as promql needs, it is a bit different.
But the feature you requested seems like a good idea for me.

[felixte]

I forgot about the “P” - so much time parsing fluent-bit to get the right data… thanks
but it is throwing an error now (better than NONE).

^(?:(?P<level>INFO |WARN |ERROR))

It’s saying “invalid group” & red/pink invalid regex expression - so I’m curious if it is not liking the ‘or’ pipe - I have seen that in other examples for LogQL (Loki is the source). I’m gonna pick it apart to find the error - but if you spot it please let me know. thanks

[felixte]

Actually the Grafana docs don’t show the “P” and since it’s Loki I’m not sure that’s needed there. I tried with group name and without no errors but no values either.

[dror1212]

Try using it in the simple explore feature, with the specific logs you want - try to see there what causing the problems.

[felixte]

I am able to get it in the explore, but still nothing in the variables. Format of the RE is different, which may be part of the problem.