You can add a filter to a dashboard and use the filter to refine search results or replace placeholder variables with specified values. This topic describes how to add a filter to a dashboard. The topic also provides two examples.
Prerequisites
- The indexing feature of the Logstore is enabled and indexes are configured. For more information, see Enable and configure the index feature for a Logstore.
- Analysis charts are added to the dashboard. For more information, see Add an analysis chart to a dashboard.
If the filter type is set to Replace Variable, placeholder variables must be specified for the charts on the dashboard.
Background information
- Filter: uses key-value pairs as a filtering condition. The condition is appended to
the original query statement by using the
AND
orNOT
operator. By using the AND operator, the new query statement is in the Key: Value AND [search query] | [sql query] format. This statement means to search the query results of the original query statement for log entries that contain Key:Value. For the Filter type, you can select or enter multiple key-value pairs. When you select multiple key-value pairs as the filtering condition, the logical OR operator is used between the pairs. - Replace Variable: specifies a variable and the variable value. If the dashboard contains a chart for which the same variable is configured, the variable in the query statement of the chart is replaced with the selected value when a filtering operation is performed. This applies to all charts for which the same variable is configured.
Procedure
Example 1: Use different time granularities to analyze logs
After you collect NGINX access logs, you need to query these logs in real time. You can use a query statement to view the number of page views (PVs) per minute. However, if you need to view the number of PVs per second, you must modify the value of __time__ - __time__ % 60 in the query statement. To simplify this operation, you can use a filter to replace variables in the query statement.