Using parsed log fields in template variables

I have logs with the following labels and fields (parsed by fluentbit parser):

Is there any way to use the value of the ‘level’ field in a Grafana template variable? So far I haven’t found a way to do it.


Did you ever find a way to do this? I can’t get a variable to use anything but a hard label as sent in the stream (not extracted or detected fields).

Didn’t find a way wither, currently using regex to extract (take everything after level= untill the space). something like:
regexp “.level=(?P[^ ]).*$”

I can’t seem to get REGEX to work either. I’ve validated the REGEX at I assume that should work. I put in a feature discussion post here that captures the PATTERN based extraction.

can you send the regex you used? you need to add the P and everything as promql needs, it is a bit different.
But the feature you requested seems like a good idea for me.

I forgot about the “P” - so much time parsing fluent-bit to get the right data… thanks
but it is throwing an error now (better than NONE).

^(?:(?P<level>INFO |WARN |ERROR))

It’s saying “invalid group” & red/pink invalid regex expression - so I’m curious if it is not liking the ‘or’ pipe - I have seen that in other examples for LogQL (Loki is the source). I’m gonna pick it apart to find the error - but if you spot it please let me know. thanks

Actually the Grafana docs don’t show the “P” and since it’s Loki I’m not sure that’s needed there. I tried with group name and without no errors but no values either.

Try using it in the simple explore feature, with the specific logs you want - try to see there what causing the problems.

I am able to get it in the explore, but still nothing in the variables. Format of the RE is different, which may be part of the problem.

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.