4

I tried

jsonPayload.elapsed_ms > 5000

and I'm clearly getting a lexicographical comparison of the character "5" because I only see results that are "6", "7", "8", "9" (see final number per line, after the "200"):

enter image description here

I tried

double(jsonPayload.elapsed_ms)>5000

as well but doesn't seem to be the right syntax.

There's a whole section on conversions here but no examples.

c69
  • 19,951
  • 7
  • 52
  • 82
Andrew Cheong
  • 29,362
  • 15
  • 90
  • 145

2 Answers2

5

Here's a pretty terrible workaround until someone posts a better answer.

jsonPayload.elapsed_ms=~"[5-9][0-9][0-9][0-9]"
Andrew Cheong
  • 29,362
  • 15
  • 90
  • 145
  • Thanks so much for this, (I deleted my long comment based answer after realizing I made an error), btw both of your suggested syntaxes also worked for values 0-999 jsonPayload.elapsed_ms=~"^\d{1,3}$" jsonPayload.elapsed_ms=~"^(\d{1}|\d{2}|\d{3})$" – neoakris Jul 25 '22 at 16:07
  • @neokyle - Oh, you didn't have to delete your answer though. Your alternate syntaxes might help other people. I'd undelete it but it's up to you (: And thanks for trying them and letting me know they work! – Andrew Cheong Jul 25 '22 at 16:36
2

I am from the Cloud Logging team.

Since the jsonPayload.elapsed_ms field is being logged as a string, the range comparison is evaluated lexicographically. Is it possible for you to log the field as a numeric type in the JSON payload?

https://cloud.google.com/logging/docs/view/advanced-queries#values_conversions documents the auto-conversions when evaluating a filter expression. However, it is currently not supported to cast the logged values to a different type at query time.

We plan to add support for this in the query language. Please follow and +1 the following public issue https://issuetracker.google.com/issues/140348005 for updates.

Summit Raj
  • 820
  • 5
  • 10