Elastic Search Lucene Query in Template Variables

Grafana Elasticsearch
1

Hi Friends,

I am facing issue with special characters in Template Variables Query.

For Example:
{“find”: “terms”, “field”: “ci_unique_id”,“query”: "ci_unique_id:* \|Frontends\|Apps\| * \|URLs\| * "}

In above Query I want data to be like Super\|host\|process\|Agg\|Frontends\|gtl\|errors\|URL\|wps

1.Want only 4 pipe symbols infront of Fronends not more than 4. If I am using “* \|” its getting two or 5 or 7 pipes infront of Frontends.
So how to handle this case in template variable Query.

  1. I dont want to filter these data using Regex in template varibles as we have only option of performing one group match.

If i use like:
{“find”: “terms”, “field”: “ci_unique_id”,“query”: "ci_unique_id:* \| * \| * \| * \|Frontends\|gtl\| * \|URL\| * "}
If I give four *\| infront of frontends still getting n number of pipes:
output:
Super|host|process|Agg|abc|def|ghi|Frontends|gtl|errors|URL|wps

2

My query is working fine in postman but it’s not accepting the special characters in template variable.

{“find”: “terms”, “field”: “ci_unique_id”,“query”: "ci_unique_id:([^|] * ) \ | ([^|] * ) \ |([^|] * ) \ | ([^|] * )\ |Frontends|gtl| * |URL \ | * "}

3

Just use:
{“find”: “terms”, “field”: “ci_unique_id”,“query”:""}

Then you can filter it out using
Regex: /Super|host|process|Agg|abc|def|ghi|Frontends|gtl|errors|URL|wps/

Regards,
Fadjar Tandabawana

1 Like