Using parsed log fields in template variables

I have logs with the following labels and fields (parsed by fluentbit parser):

Is there any way to use the value of the ‘level’ field in a Grafana template variable? So far I haven’t found a way to do it.


Did you ever find a way to do this? I can’t get a variable to use anything but a hard label as sent in the stream (not extracted or detected fields).

Didn’t find a way wither, currently using regex to extract (take everything after level= untill the space). something like:
regexp “.level=(?P[^ ]).*$”

I can’t seem to get REGEX to work either. I’ve validated the REGEX at I assume that should work. I put in a feature discussion post here that captures the PATTERN based extraction.

can you send the regex you used? you need to add the P and everything as promql needs, it is a bit different.
But the feature you requested seems like a good idea for me.

I forgot about the “P” - so much time parsing fluent-bit to get the right data… thanks
but it is throwing an error now (better than NONE).

^(?:(?P<level>INFO |WARN |ERROR))

It’s saying “invalid group” & red/pink invalid regex expression - so I’m curious if it is not liking the ‘or’ pipe - I have seen that in other examples for LogQL (Loki is the source). I’m gonna pick it apart to find the error - but if you spot it please let me know. thanks

Actually the Grafana docs don’t show the “P” and since it’s Loki I’m not sure that’s needed there. I tried with group name and without no errors but no values either.

Try using it in the simple explore feature, with the specific logs you want - try to see there what causing the problems.

I am able to get it in the explore, but still nothing in the variables. Format of the RE is different, which may be part of the problem.