Showing log counts by error type

[cinimins]

Hello,

I would like to make a stacked column chart with number of errors by hour and error type (warning, error, etc)

The log lines look like this:

[2023-07-19T03:55:16,043][ERROR][o.o.s.i.DetectorIndexManagementService] [opensearch-cluster-master-2] info deleteOldIndices

I was filtering out INFO messages, parsing the error type using a regex (which both work so far), but I cannot group it by error type.

index=* "pod"="*opensearch*"
| search NOT "[INFO ]"
| rex field=_raw "^\[([0-9\-T:,]*)\]\[(?<type>[A-Za-z ]*)\]"
| timechart span=1h count
```| stats avg(count) as count by Hour type```
| chart avg(count) AS count BY Hour type

I only get one value per hour, labeled as "count". Any suggestion how I could split it by Hour *and* type?

Thank you!

[gcusello · Accepted solution]

Hi @cinimins,

after the timechart command you have only two fields: _time and count, so type isn't still available.

then you could use a simplerregex:

| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"

then, you don't need to use the search command after the main search, in this way you have a slower search.

that you can test at https://regex101.com/r/VN8vWd/1

Anyway, please see this:

index=* "pod"="*opensearch*" NOT "[INFO]"
| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"
| eval Hour=strftime(_time,"%H")
| chart count OVER Hour BY type

Ciao.

Giuseppe

[cinimins]

Thanks for your help, it works! I haven't seen the OVER keyword before 🙂