gistfile1.txt

from(bucket: "devrel-platform-metrics")
  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
  |> filter(fn: (r) => r["_measurement"] == "docker_hub")
  |> filter(fn: (r) => r["_field"] == "pull_count")
  |> group(columns: ["url"])
  |> count()
  |> group()
  |> sort(columns: ["_value"], desc: true)

Thanks Dave. I didn't get this working yet. I'm not really sure if it's the structure of the data that I don't understand or how to query the data.

I've got Telegraf collecting PHP/Apache error logs. A line looks like this:

apache_error,host=9d9d173e1f57,loglevel=notice,path=/var/log/app/error.log message="PHP Notice:  Undefined index: foo in /var/www/bar.php on line 1447",timestamp="Mon Jun 08 07:52:09.369482 2020",module="php7",pid=23733i,client="12.34.56.78",clientport="61360" 1591632439038711800

Am I right in thinking that gets imported like below? loglevel is a tag, so it applies to all of them, I think? Should anything else be a tag? Would importing the data differently make it easier to query?

measurement	time	loglevel	field	value
apache_error	1591632439038711800	notice	host	9d9d173e1f57
apache_error	1591632439038711800	notice	path	/var/log/app/error.log
apache_error	1591632439038711800	notice	message	PHP Notice: Undefined index: foo in /var/www/bar.php on line 1447
apache_error	1591632439038711800	notice	timestamp	Mon Jun 08 07:52:09.369482 2020
apache_error	1591632439038711800	notice	module	php7
apache_error	1591632439038711800	notice	pid	23733i
apache_error	1591632439038711800	notice	client	12.34.56.78
apache_error	1591632439038711800	notice	clientport	61360

The information I'd like to get from this:

How many errors are occurring?

A bar chart (or something) showing the total number or errors logged each minute/hour/day.

• Potentially with each bar broken down into loglevels (is that a histogram?)
• Potentially with the time of releases marked on there.

What are the most common errors?

error	count
PHP Notice: Undefined index: foo in /var/www/bar.php on line 1447	1000
PHP Warning: Use of undefined constant BAR in /var/www/bar.php on line 1447	267
PHP Error: Class Boz not found in /var/www/bar.php on line 1447	12
Something else	1

For the first query I just need to filter to any one of the fields to deduplicate them, right. I think that's basically it. The Histogram automaticallyt breaks them into loglevels.

from(bucket: "bucket")
  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
  |> filter(fn: (r) => r["_measurement"] == "apache_error")
  |> filter(fn: (r) => r["_field"] == "client")

OK. I'm watching some videos so I actually understand this stuff. Hopefully I'll be able to work out the other query.