0

Picture of Problem

ElasticSearch query works when hard coded, but fails when using Grafana variable value substitution:

Query: +nginx.access.upstream.response: [*, 1**, 2**, 3**, 4**, 5**, 500]
Each of these queries work when you hard code those values in the query.

Example Query: +nginx.access.upstream.response: 1** 
               ^That works shows a table of data instead of "No data to show"

Although that works, it's better to use a variable with 7 values allows you to use 1 panel to display the same data that could be put in 7 hard coded panels, so that you end up with a cleaner user interface.

The problem is now that you've switched the hardcoded values to variable populated values the query no longer works.
The plugged in variable values [* and 500] work
The plugged in variable values [1**, 2**, 3**, 4**, 5**] don't work / result in "No data to show" as seen above.

There's something funny going on when the values get substituted into the query.
Q1.) What's the best tool/method to debug the true value of the variable after substitution/Figure out why it' failing?
Q2.) What's a method of fixing it/achieving the desired end result?

neoakris
  • 4,217
  • 1
  • 30
  • 32

1 Answers1

0

Q1.) What's the best tool/method to debug the true value of the variable after substitution/Figure out why it' failing?

Answer 1: Query Inspector
1** --when substituted becomes--> 1\\*\\*
which explains why it didn't work

A1.) Query Inspector

Q2.) What's a method of fixing it/achieving the desired end result?

Answer 2: What worked for me was to avoid using the special character * in the variable values.
I rename the variable to HTTP Code Prefix and used the values [*,1,2,3,4,5]
I then used the Query: +nginx.access.upstream.response: $http_code_prefix*

neoakris
  • 4,217
  • 1
  • 30
  • 32
  • This is meant to be a knowledge share Q&A, but please let me know if there's a better solution to avoid the variable value being escaped when substituted. – neoakris Jul 25 '19 at 15:59