Hi,
I am trying color code App_State cells based on it state in the below table.
App_Name App_State
abc Running
cde Stopped
fgh Running
xyz Running
mnp Stopped
In the dashboard Source:
<dashboard theme="dark" refresh="30">
<label>ABC</label>
<row>
<panel>
<table>
<search>
<query>index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?<App_Name>\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w+\s]+)\sNumber" | table App_Name,App_State</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="App_State">
<colorPalette type="map">{"Running":#53a051,"Stopped":#dc4e41}</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
But I am not getting any colors in the cells. Can someone please look into it and help me get the cells with desired colors..?
Not sure if this will help given the logs you shared seem to fit your pattern anyway, but this should remove any trailing space there might have been
| rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number"
The format clause looks like it should work too.
Given that the app states are single words, do you need the +\s in the rex? Perhaps you are ending up with a trailing space which then won't match your colour map?
Hi ITWhisperer,
Thanks for your prompt response.
Actually the app states are not single words. It can be as App_State=Partially stopped. So I have used it.
If that's the issue then can you please help me with the rex command to extract it in in the desired way.
Below are the logs:
log1: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Not running Synchronization : In Sync State : Stopped Number of template version : 6
log2: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Running Synchronization : Out of Sync State : Partially stopped Number of template version : 6
Not sure if this will help given the logs you shared seem to fit your pattern anyway, but this should remove any trailing space there might have been
| rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number"
The format clause looks like it should work too.
Hi ITWhisperer,
It worked..!! I can now see the cells in colors as desired.
Thank you very much for your support...!!