Need help to color code cells

[Mrig342]

Hi,

I am trying color code App_State cells based on it state in the below table.

App_Name    App_State
abc                Running
cde                Stopped 
fgh                 Running
xyz                Running
mnp              Stopped

In the dashboard Source:

<dashboard theme="dark" refresh="30">
<label>ABC</label>
<row>
<panel>
<table>
<search>
<query>index=main host="abcde" | rex field=_raw "(?ms)Label\s+Name\s:\s(?&lt;App_Name&gt;\w+\S+)" | rex field=_raw "(?ms)Sync\sState\s:\s(?&lt;App_State&gt;[\w+\s]+)\sNumber" | table App_Name,App_State</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="App_State">
<colorPalette type="map">{"Running":#53a051,"Stopped":#dc4e41}</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>

But I am not getting any colors in the cells. Can someone please look into it and help me get the cells with desired colors..?

[ITWhisperer]

Given that the app states are single words, do you need the +\s in the rex? Perhaps you are ending up with a trailing space which then won't match your colour map?

[Mrig342]

Hi ITWhisperer,

Thanks for your prompt response.

Actually the app states are not single words. It can be as App_State=Partially stopped. So I have used it.

If that's the issue then can you please help me with the rex command to extract it in in the desired way.

Below are the logs:

log1: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Not running Synchronization : In Sync State : Stopped Number of template version : 6

log2: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Running Synchronization : Out of Sync State : Partially stopped Number of template version : 6

[ITWhisperer · Accepted solution]

Not sure if this will help given the logs you shared seem to fit your pattern anyway, but this should remove any trailing space there might have been

| rex field=_raw "(?ms)Sync\sState\s:\s(?<App_State>[\w\s]+\w)\s+Number"

The format clause looks like it should work too.

[Mrig342]

Hi ITWhisperer,

It worked..!! I can now see the cells in colors as desired.

Thank you very much for your support...!!