Aggregating more than two fields into a graph

Follow

gergely brautigam

• September 14, 2018 15:03
• Edited

Hi.

 

I'm trying to parse an access log. We have multiple stages like prod, prod2, prod3... 

I'm trying to show memory using per stage / timeslice.  So I've come up with something like this: 

 

(_sourceCategory=syslog namespace=*.fpm-access)
| parse regex "(?<status_code>\d+?) memory_kb=(?<memory>\d+?) %cpu=(?<cpu>\d+\.\d+?)"
| timeslice 400 buckets
| count by _timeslice, memory, stage
| transpose row _timeslice column memory, stage

 

( I'm not even dreaming of showing status and CPU at this stage on one graph. Probably not even a good idea. I'll extract that. )

 

Now this doesn't work because the columns will be 23424|prod, 23424255|prod, 248696|prod2, 98373|prod3... and so on. 

But what I want is a multicolored memory graph where each color is a different stage but the memory is shown as continuation on a timescale.

I read the documentation and looked at other people's graphs but this seem to be either not possible or I'm trying to approach this problem from the wrong angle? I think this should be possible but can't get it to work. I tried group by, order by everything to no avail.

Please help. :)

0

• 

  Kevin Keech

  • September 21, 2018 18:19

  What is the memory value you want to show per time bucket? Average, min, max? The following example should show you the average memory per timeslice and stage and get you a chart with the multiple values. 
  
  

  (_sourceCategory=syslog namespace=*.fpm-access)
  | parse regex "(?<status_code>\d+?) memory_kb=(?<memory>\d+?) %cpu=(?<cpu>\d+\.\d+?)"
  | timeslice 400 buckets
  | avg(memory) as avg_memory by _timeslice, stage
  | transpose row _timeslice column stage

  If you want the max memory for each stage per timeslice you can simply change the "avg" operation to a "max" operation.

  (_sourceCategory=syslog namespace=*.fpm-access)
  | parse regex "(?<status_code>\d+?) memory_kb=(?<memory>\d+?) %cpu=(?<cpu>\d+\.\d+?)"
  | timeslice 400 buckets
  | max(memory) as max_memory by _timeslice, stage
  | transpose row _timeslice column stage

  I hope this might be what you were looking for. 

  0

  Permalink

Please sign in to leave a comment.