2

I have what should be a straightforward request, but I have looked around a bit and have not seen an example of how to accomplish this. Basically, I have a couple of dashboard variables so that users can filter log results. The Log Search textbox variable filters the logs by text entered and the Search Field dropdown variable defaults to “All Fields”. Users can update that to search for text in a specific field.

I have a panel to display the Log File Search Results and the Grafana Loki Query in the panel to execute the filtering. I have everything working except for the default “All Fields” situation. I’m already filtering all of the logs based on the text entered. Then when I get to the specific field filtering I want to skip that extra filter if “All Fields is selected”. So I just want to do a simple conditional expression, something like ${searchField:value} == ‘All’ or [field filter].

This seems like basic functionality, but doesn’t seem available? So hopefully I’m just missing something. I broke out the single query into two separate ones, searchAllFields and searchIndividualFields, and was thinking I could use one or the other in the transform based on the Search Field variable selection. Still unclear how to accomplish that in the transform.

I feel like this is something that must come up again and again, querying against an entire datasource or just a single field in that datasource. How are people accomplishing this?

enter image description here

Dashboard variables for textBoxSearchValue and searchField:

enter image description here

Improve this question
3
  • 1
    AFAIK, transformations still don't support variables, so this wouldn't work, at least for now. Commented Sep 5, 2023 at 19:46
  • And regarding general issue: it's not clear for me what you expect to happen, if "All" is selected, and something is present in the input for second variable: should your query search in all fields, or it should return all logs without any filtering applied? Commented Sep 5, 2023 at 19:47
  • 1
    Was originally just trying to keep it all in one query. The textBoxSearchValue always filters the logs, then users can enable specific field filtering. So user enters "0001" in textbox with field dropdown set to "All". This returns too many results, so they select "ExceptionId" in the dropdown. Now the additional filter activates and only returns records where the field "ExceptionId" has "0001" in it. I just need a way to toggle the specific field filtering. If "All", no additional filtering after the standard textBoxSearchValue filter of all the logs. Commented Sep 6, 2023 at 14:29

1 Answer 1

Reset to default
1

Loki doesn't allow comparison of two arbitrary strings in it's label filtering expressions. The only way to introduce something like you want I can imagine is to work with some labels, perhaps non existing ones.

You can add or ${searchField:value} = "" to your query (to the last part). Assuming your items don't have a All label (if does - change value of All fields to something that doesn't exist), this will result in filtering either by required field or by non-existing field being equal to empty string (which is always true).

This solution is not ideal: if some of your labels can be empty, and you'll try to apply filtering over them, empty ones will be returned together with those containing search term. At the moment, I don't think this problem can be solved.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Thanks for the information. I appreciate it. Got no response from the Grafana forums. My workaround was creating two separate panels one with All Results, one filtered by selected column. It's clunky, but functional and I put each under a collapsible row so we can just keep the panel we don't use often collapsed most of the time. Good enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.