Tactics for nailing Timelion label Regexes

Elastic Stack Kibana
1

I've noticed that the Regex engine for timelion labels does not quite work as expected. For example I've tried plugging the regex in an online visualizer such as Regex Tester, it will match what I expect and then I'll plug it into timelion and get something absolutely different.

For example on https://www.regexpal.com/ with this input:

q:kubernetes.pod.name:qvp6rolm* AND _exists_:kubernetes.container.memory.usage.bytes > kubernetes.pod.name:qvp6rolm-xis88m7q-mycontainer-0 > avg(kubernetes.container.memory.usage.bytes)

and this regex: kubernetes\.pod\.name:(\S+) >

I expect the matched group to be: qvp6rolm-xis88m7q-mycontainer-0

However, on timelion the output is: q:kubernetes.pod.name:qvp6rolm* AND _exists_:kubernetes.container.memory.usage.bytes > qvp6rolm-xis88m7q-quorum-node-0 avg(kubernetes.container.memory.usage.bytes)

To fix the regex for timelion I have to change the regex to: .*kubernetes\.pod\.name:(\S+) >.*

Is there a utility that I can use to rapidly prototype these regexes in order to visually validate them before using them in timelion has a high overhead when recomputing the regex?

Also, could we perhaps think about giving access to fields in the time series and just using a templated string that references time series fields instead of a regex? For example if I split on name, it would be convenient to just label each series with the name field.

2

I assume you are talking about making formatted labels for the data series in Timelion. If not, can you provide your entire Timelion query?

I would recommend just starting with the output that Timelion provides as the label, and work on formatting that. Timelion uses JavaScript regular expressions, so you can put the output string into a test string in a Javascript console, and use the String#match function to tune the regex.

> const myStr = "hello test 123"
"hello test 123"
> const { 0: input, 1: group } = myStr.match(/^hello (.*123)/);
undefined
group
"test 123"

Most web browsers have a built-in Javascript console that you can play with - I did the above test in the Chrome Web Inspector. There are some web services that let you save snippets, such as https://runkit.com. Example: RunKit

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.