Replace _sourceName for count

Follow

Eren Güven

• November 01, 2018 11:26

I'd like to do `count _sourceName` where most of the values look as I want them except some ECS services where their naming is `{cluser}-{task-definition}-{revision}-{containername}-{id}` and I'd like to combine all entries by a service so for example in this case rewrite _sourceName to just task-definition part.

How can I do that?

Thanks

0

• 

  Azriel Nguyen

  • November 01, 2018 16:42

  Try this Eren,

  | replace(_sourcename,"{cluser}-{task-definition}-{revision}-{containername}-{id}","{task-definition}") as _sourcename 

   

  Unfortunately, it doesn't appear that wildcard works for this.  But knowing Sumo, there's better ways to skin this gator.

  If you only have a few of such _sourcenames, this should suffice.

   

  Az

  0

  Comment actions Permalink
• 

  Azriel Nguyen

  • November 01, 2018 17:04
  • Edited

  can use regex, try this:

  | replace(_sourcename,/.*{task-definition}.*/,"{task-definition}") as _sourcename 

  1

  Comment actions Permalink
• 

  Eren Güven

  • November 01, 2018 17:21

  Replace with regex was exactly what I was looking for, thanks Azriel!

  0

  Comment actions Permalink
• 

  Azriel Nguyen

  • November 01, 2018 17:31

  no problem, happy Sumo'ing

  0

  Comment actions Permalink

Please sign in to leave a comment.