0

I am really new to GCP and creating metrics. We use Grafana to display the count of event logs with the help of "google_logging_metric" created.

My use case was Let's say we have a log

The Number is {variable}"

Possible values for variable is a 5 digit Number and there will be multiple occurrences of logs with each variable.

I am creating Metric through terraform as follows

resource "google_logging_metric" "" {
  name    = ""
  project = var
  filter  = "resource.type=\"k8s_container\" resource.labels.container_name=\"\" jsonPayload.message=~\"(The Number is {something should be added here?})\""
  metric_descriptor {
    metric_kind  = "DELTA"
    value_type   = "INT64"
    display_name = ""
    labels {
      key         = "event"
      value_type  = "STRING"
      description = ""
    }
  }

  label_extractors = {
    event     = "REGEXP_EXTRACT(jsonPayload.message, \"(The Number is {something should be added here?})\")"
  }
}

What i like to do was to group the log occurrences like "The Number is XXXXX", "The Number is YYYYY", "The Number is ZZZZZ" on grafana. Can anyone suggest How i can achieve this? Do I have to modify the metric or something on grafana dashboard?

user16353001
  • 49
  • 8

1 Answers1

0

Cloud Logging supports regular expression so if the log entries you need to filter varies between numbers from 1 to 3, you can try something similar as below:

jsonPayload.message =~ "The Number is\s*[1-3]"

Here is the official documentation about Cloud Logging regex: https://cloud.google.com/blog/products/management-tools/cloud-logging-gets-regular-expression-support

CaioT
  • 1,973
  • 1
  • 11
  • 20
  • Actually, The variable is 5 digit number. But, let me try applying regex to extract the log. – user16353001 Jan 03 '22 at 22:28
  • When added this (log + "\\s\\d{5}") when creating metric, seeing this error "Error 400: Failed to parse extractor expression: unsupported escape sequence in a string literal". I also tried with "(log + "\s\d{5}")" and "(log + "\\\\s\\\\d{5}")". No luck – user16353001 Jan 04 '22 at 15:46
  • Can you update your original post with the new code? – CaioT Jan 04 '22 at 17:06