This topic describes how to configure and use a filter on a dashboard of a Logstore. Filters help you refine search results or replace placeholder variables with the values specified on the dashboard.
- Filter: Add a key and value as a filtering condition before the query statement
[search query]. The new query statement is
key:value AND [search query], which means to search the result of the original query statement for logs that contain
key:value. For the Filter type, you can select or enter multiple key values. When you select multiple values as filtering conditions, the logical
ORoperator is used between them.
- Replace Variable: Specify a variable placeholder. If the dashboard contains a chart configured with the variable placeholder, the variable placeholder in the query statement of the chart is replaced with the selected value.
- The key value component, which indicates a filter operation.
- The list item component, which corresponds to the key.
- Log on to the Log Service console, and then click the target project name.
- In the left-side navigation pane, click the Dashboard icon.
- In the dashboard list, click the name of the target dashboard.
- On the dashboard page, click Edit to enter the edit mode.
- Click the icon, and then set the filter parameters. Click OK.
Table 1. Filter parameters Parameter Description Filter Name The name of the filter. Title If you turn on this switch, the title of the chart configured with this filter is displayed on the dashboard. Border If you turn on this switch, a border is added to the chart configured with this filter. Background If you turn on this switch, a white background is added to the chart configured with this filter. Key
Note The variable placeholder must be the same as the one you specified. Otherwise, it cannot be replaced.
- For the Filter type, the Key is the key in the filtering condition.
- For the Replace Variable type, the Key is the specified variable placeholder.
Type The filter type. Valid values:
- Replace Variable
- If you select Filter, a List Item is the value of the condition used to filter the results of a query statement. You can set multiple values. After the filter takes effect, you can select one or more values when you view the dashboard.
- If you select Replace Variable, a List Item is the value that replaces a specified variable placeholder. You can set multiple values. After the filter takes effect, you can select one or more values when you view the dashboard.
Alias The alias of the column. This parameter is valid only when you select Filter. After you set an alias, it is displayed in the filter on the dashboard. Global filter This switch indicates whether to filter the specified value in all fields. This switch is turned off by default. The switch is valid only when you select the Filter type.
- To filter the specified value in all fields, turn on the Global filter switch.
- To filter the specified value in specified keys, turn off the Global filter switch.
List items Static list item The list items that you add to the filter.
To add a list item, enter it in the Add Static List Item text box, and then click Add.
Dynamic list item The list items that are dynamically displayed in the filter. The list items are the results of the specified query statement.
To add dynamic list items, turn on the Add Dynamic List Item switch, enter a query statement, and then click Search. The dynamic list items are added and displayed.
[search query] | [sql query]. The filter query is appended to the original query statement to filter data.
- If the filter type is Filter, the value to be filtered is added before
[search query]to form a new query statement by using the logical
ANDoperator. The new query statement is
key:value AND [search query].
- If the filter type is Replace Variable, the filter queries all charts containing variable
placeholders on the dashboard and replaces the variable placeholders with the selected
Example 1: Use different time granularities to analyze logs
When you collect NGINX access logs, you can query and analyze these logs in real time. For more information, see Collect and analyze NGINX access logs.
You can use a query statement to view the number of page views (PVs) per minute. However,
if you want to view the number of PVs per second, you must modify the value of
__time__ - __time__ % 60 in the query statement. To simplify this operation, you can use a filter to replace
variables in the query statement.
- Use the following query statement to view the number of PVs per minute:
* | SELECT date_format(__time__ - __time__ % 60, '%H:%i:%s') as time, count(1) as count GROUP BY time ORDER BY time
- Add the analysis chart to a dashboard, select
60in the query statement to generate a variable placeholder, and then set the variable name to
interval. The default value of this variable is 60.
- Add a filter and set the filter type to Replace Variable.
- Type: Select Replace Variable.
- Key: Enter
- Static List Items: Add
120as static list items. The default unit is seconds.
- In the Filter section of the dashboard, select
1from the Interval drop-down list to view statistics by second.After the variable placeholder is replaced, the query statement is as follows:
* | SELECT date_format(__time__ - __time__ % 1, '%H:%i:%s') as time, count(1) as count GROUP BY time ORDER BY time
Example 2: Switch between request methods
You can add dynamic list items to a filter to dynamically switch between request methods.
In example 1, the query statement starts with an asterisk (
*), which means no condition is set to filter the query results and all logs are queried.
You can add another filter to view the PV data of different request
- Add a filter on the dashboard and turn on the Add Dynamic List Item switch.
Set the parameters as follows:
- Type: Select Filter.
- Key: Enter
- Select Logstore: Select the Logstore to which the dashboard belongs.
- Add Dynamic List Item: Enter a query statement to obtain the relevant dynamic list items, and then click OK.
- In the Filter section of the dashboard, select
POSTfrom the method drop-down list.Only the PV data whose
POSTis displayed in the chart. The query statement is changed as follows:
(*) and (method: POST) | SELECT date_format(__time__ - __time__ % 60, '%H:%i:%s') as time, count(1) as count GROUP BY time ORDER BY time