This topic describes how to configure and use a filter on a dashboard of a Logstore. Filters help you refine search results or replace placeholder variables with the values specified on the dashboard.

Prerequisites

  • The index of the Logstore is enabled and configured. For more information, see Enable and set indexes.
  • A dashboard is created. For more information, see Create and delete a dashboard. A variable placeholder is specified if the filter type is set to Replace Variable.

Background information

Each chart on a Log Service dashboard functions as a query statement. When you configure a filter on a dashboard, the specified filtering condition and variable placeholder apply to all charts on the dashboard. You can configure the following two types of filters:
  • Filter: Add a key and value as a filtering condition before the query statement [search query]. The new query statement is key:value AND [search query], which means to search the result of the original query statement for logs that contain key:value. For the Filter type, you can select or enter multiple key values. When you select multiple values as filtering conditions, the logical OR operator is used between them.
  • Replace Variable: Specify a variable placeholder. If the dashboard contains a chart configured with the variable placeholder, the variable placeholder in the query statement of the chart is replaced with the selected value.

Components

Each chart has one or more filters. Each filter consists of the following two components:
  • The key value component, which indicates a filter operation.
  • The list item component, which corresponds to the key.

Procedure

  1. Log on to the Log Service console, and then click the target project name.
  2. In the left-side navigation pane, click the Dashboard icon.
  3. In the dashboard list, click the name of the target dashboard.
  4. On the dashboard page, click Edit to enter the edit mode.
  5. Click the Filter icon icon, and then set the filter parameters. Click OK.
    Table 1. Filter parameters
    Parameter Description
    Filter Name The name of the filter.
    Title If you turn on this switch, the title of the chart configured with this filter is displayed on the dashboard.
    Border If you turn on this switch, a border is added to the chart configured with this filter.
    Background If you turn on this switch, a white background is added to the chart configured with this filter.
    Key
    • For the Filter type, the Key is the key in the filtering condition.
    • For the Replace Variable type, the Key is the specified variable placeholder.
    Note The variable placeholder must be the same as the one you specified. Otherwise, it cannot be replaced.
    Type The filter type. Valid values:
    • Filter
    • Replace Variable
    Note
    • If you select Filter, a List Item is the value of the condition used to filter the results of a query statement. You can set multiple values. After the filter takes effect, you can select one or more values when you view the dashboard.
    • If you select Replace Variable, a List Item is the value that replaces a specified variable placeholder. You can set multiple values. After the filter takes effect, you can select one or more values when you view the dashboard.
    Alias The alias of the column. This parameter is valid only when you select Filter. After you set an alias, it is displayed in the filter on the dashboard.
    Global filter This switch indicates whether to filter the specified value in all fields. This switch is turned off by default. The switch is valid only when you select the Filter type.
    • To filter the specified value in all fields, turn on the Global filter switch.
    • To filter the specified value in specified keys, turn off the Global filter switch.
    List items Static list item The list items that you add to the filter.

    To add a list item, enter it in the Add Static List Item text box, and then click Add.

    Dynamic list item The list items that are dynamically displayed in the filter. The list items are the results of the specified query statement.

    To add dynamic list items, turn on the Add Dynamic List Item switch, enter a query statement, and then click Search. The dynamic list items are added and displayed.

    Add a dashboard filter

Examples

You can use a filter to modify the query statement on a dashboard and replace variable placeholders in the charts on the dashboard. Each chart represents a query statement in the format of [search query] | [sql query]. The filter query is appended to the original query statement to filter data.
  • If the filter type is Filter, the value to be filtered is added before [search query] to form a new query statement by using the logical AND operator. The new query statement is key:value AND [search query].
  • If the filter type is Replace Variable, the filter queries all charts containing variable placeholders on the dashboard and replaces the variable placeholders with the selected value.

Example 1: Use different time granularities to analyze logs

When you collect NGINX access logs, you can query and analyze these logs in real time. For more information, see Collect and analyze NGINX access logs.

You can use a query statement to view the number of page views (PVs) per minute. However, if you want to view the number of PVs per second, you must modify the value of __time__ - __time__ % 60 in the query statement. To simplify this operation, you can use a filter to replace variables in the query statement.

  1. Use the following query statement to view the number of PVs per minute: 
    * | SELECT date_format(__time__ - __time__ % 60, '%H:%i:%s') as time, count(1) as count GROUP BY time ORDER BY time
  2. Add the analysis chart to a dashboard, select 60 in the query statement to generate a variable placeholder, and then set the variable name to interval. The default value of this variable is 60.
    Add a chart to a dashboard
  3. Add a filter and set the filter type to Replace Variable.
    • Type: Select Replace Variable.
    • Key: Enter interval.
    • Static List Items: Add 1 and 120 as static list items. The default unit is seconds.
  4. In the Filter section of the dashboard, select 1 from the Interval drop-down list to view statistics by second.
    After the variable placeholder is replaced, the query statement is as follows: 
    * | SELECT date_format(__time__ - __time__ % 1, '%H:%i:%s') as time, count(1) as count GROUP BY time ORDER BY time
    Filter

Example 2: Switch between request methods

You can add dynamic list items to a filter to dynamically switch between request methods. In example 1, the query statement starts with an asterisk (*), which means no condition is set to filter the query results and all logs are queried. You can add another filter to view the PV data of different request methods.

  1. Add a filter on the dashboard and turn on the Add Dynamic List Item switch.
    Set the parameters as follows:
    • Type: Select Filter.
    • Key: Enter method.
    • Select Logstore: Select the Logstore to which the dashboard belongs.
    • Add Dynamic List Item: Enter a query statement to obtain the relevant dynamic list items, and then click OK.
    Add dynamic list items
  2. In the Filter section of the dashboard, select POST from the method drop-down list.
    Only the PV data whose method is POST is displayed in the chart. The query statement is changed as follows: 
    (*) and (method: POST) | SELECT date_format(__time__ - __time__ % 60, '%H:%i:%s') as time, count(1) as count GROUP BY time ORDER BY time
    Dynamic list items