Loki LogQL topk aggregate function - grafana

I've started shipping traefik access logs (in JSON) to Grafana Loki and wanted to visualize the top 3 ClientHosts.
This is the LogQL I have written for this but it returns all ClientHosts for the selected time range instead of only the top 3.
What am I missing?
topk(3, sum by (ClientHost)(count_over_time({filename="/var/log/traefik/access-json.log"}|json[5m])))

Are you using the "Explore" on Grafana? Do not forget to select the following option:
Query type = Instant

Related

Graphing web url hits via loki logs in grafana: how to get count_over_time to return 0 instead of null for an empty time period?

I am trying to graph the hits on a particular url over time using loki log data in grafana. I have the following LogQL query:
sum(
count_over_time(
{job="nginx-access", hostname="myhost", filename="/var/log/nginx/myhost_access.log"}
| json
| request = "/news"
[1m]
)
)
But the count_over_time call counts empty ranges as null not 0. This then causes issues when graphing this. The size of an empty set is 0, not null. This seems very odd. You can see this here:
How can i replace all the null results with 0?
Is there another metric aggregation function that I should use?

Grafana Cloud: dividing two queries shows "no data"

In a Grafana dashboard panel, I have two queries:
rate(container_cpu_usage_seconds_total{cloud=~"${cloud}",environment=~"${environment}",location=~"${location}",container="tlm-telemetry-service",namespace="tlm"}[5m])
and
avg(kube_pod_container_resource_limits_cpu_cores{namespace="tlm"})
which can be shown well separately:
But when I try to use the "avg" one to divide the "rate" one:
rate(container_cpu_usage_seconds_total{cloud=~"${cloud}",environment=~"${environment}",location=~"${location}",container="tlm-telemetry-service",namespace="tlm"}[5m])/avg(kube_pod_container_resource_limits_cpu_cores{namespace="tlm"})
the result shows "no data".
This query used to work in Grafana Version 6.7.5, but when I tried to move it to Grafana Cloud, this problem happened.
Any one has any idea?
This throws a No data because you have two different expression data types. On the left side, you have a range vector and the right side scalar type. The query should return the same LabelSet in each part, so you need to group the right side also with the by clause.
E.g. the following query should work:
sum by (namespace,container) (rate(container_cpu_usage_seconds_total{cloud=~"${cloud}",environment=~"${environment}",location=~"${location}",container="tlm-telemetry-service",namespace="tlm"}[5m])) /
avg by (namespace,container) (kube_pod_container_resource_limits_cpu_cores{namespace="tlm"})

Grafana Reference DataSet Variable to Translate Legend Values using Postgres Driver

I have a postgres data-source in Grafana that's normalized which restricts my graph-visualization legend to show only the ID (hash) of my record. I want to make this human-readable but the id -> name mapping is in a different datasource/postgres database.
Grafana supports templating-variables which I think could allow me to load my id -> naming reference data but there isn't clear documentation on how to access the label_values as a reference-table within the postgres driver's query editor.
Is there a way to configure the template variable to load reference data (id -> name) & leverage it to translate my metric/legend ids within the grafana postgres driver?
For Example (pseudo-grafana postgres query editor):
SELECT
$__timeGroupAlias(start,$__interval),
animal_names.__value AS metric,
count(dog.chewed_bones) AS “# bones chewed“
FROM animals.dog dog
JOIN $TEMPLATE_VAR_REF_DATA animal_names ON dog.id = animal_names.__text
WHERE $__timeFilter(start_time)
GROUP BY 1,2
ORDER BY 1,2
Closest answer I found is here but doesn't get into details:
johnymachine's comment # https://github.com/grafana/grafana/issues/1032
I realized the github comment meant use a jsonb aggregate function as a variable like in the following solution:
Dashboard Variable (Type Query): select jsonb_object_agg(id,name) from animal_names;
Grafana Postgres Pseudo-Query:
SELECT
$__timeGroupAlias(start,$__interval),
animal_names::jsonb ->> dog.id::text AS metric,
count(dog.chewed_bones) AS “# bones chewed“
FROM animals.dog
WHERE $__timeFilter(start_time)

Sum query result by name specified by regex

I am using Grafana together with Prometheus to display data of my Pods from Kubernetes Cluster. Here I am displaying Memory Usage for each Pod by name:
sum (container_memory_working_set_bytes{namespace="namespace1", image!="",name=~"^k8s_.*",kubernetes_io_hostname=~"^$Node$"}) by (pod_name)
It gives correct result for each pod. In example:
namespace1-eventstore-1
namespace1-eventstore-0
avsandbox-X-64ff4d-rl9z6
avsandbox-X-64ff4d-ldfnx
avsandbox-Y-7d9df9ddff-asdf
avsandbox-Y-7d9df9ddff-dfas
avsandbox-Z-5957dbaf58dt-gds24
avsandbox-Z-5957dbaf58dt-g4gd7
Now I want to sum them by their respective names to receive following result or closest I can get to it
namespace1-eventstore
avsandbox-X
avsandbox-Y
avsandbox-Z
So in conclusion I want to sum everything that has same name before second -. How can I achieve that?
Edit.: Here's further example what I'm looking for (hopefully it's helpful to give practical example and general idea)
sum (container_memory_working_set_bytes{namespace="namespace1", image!="",name=~"^k8s_.*",kubernetes_io_hostname=~"^$Node$"}) by (pod_name="([a-zA-Z0-9]+-[a-zA-Z0-9])-.*")
But that's not possible because of syntax.

grafana define variable with prometheus query based on metrics

I am pretty new to Grafana, so the question might be an easy one:
I try to store a metric value in a variable. Therefore I setup a variable with Prometheus query:
metrics(passed_tests_total{job="MyJob"})
Surprising to me, the value returns value None, although metric values with that label exist. I verified that by setting up a 'singlestat' panel with query passed_tests_total{job="MyJob"} which works perfectly fine.
So my question: how can I store a metric value to a variable?
Remark: my approach is basing on docu http://docs.grafana.org/features/datasources/prometheus/
If you want to retrieve the value of a metric you should use query_result(), metrics() gives you the name of matching metrics, not the value itself.
Your Query should be: query_result(passed_tests_total{job="MyJob"})
And the Regex to extract just the value of metric should be /.* ([^\ ]*) .*/.