Querying and Grouping with ZincObserve and SQL
TLDR h121h needed help with a ZincObserve log query. Prabhat provided a SQL query and sorting options to achieve the desired results.
1
1
May 14, 2023 (7 months ago)
h121h
12:05 AMh121h
12:06 AM“_timestamp”: 1683926881065422,
“edgecfconnectingo2o”: false,
“edgecolocode”: “SJC”,
“edgecoloid”: 465,
“edgeendtimestamp”: “2023-05-12T21:20:36Z”,
“edgepathingop”: “wl”,
“edgepathingsrc”: “macro”,
“edgepathingstatus”: “nr”,
“edgeratelimitaction”: “”,
“edgeratelimitid”: 0,
“edgeresponsebodybytes”: 1248,
“edgeresponsebytes”: 1887,
“edgeresponsecompressionratio”: 9.23,
“edgeresponsecontenttype”: “application/json”,
“edgeresponsestatus”: 200,
“ja3hash”: “773906b0efdefa24a7f2b8eb6985bf37",
“origindnsresponsetimems”: 0,
“originrequestheadersenddurationms”: 0,
“originresponsebytes”: 0,
“originresponsedurationms”: 179,
“originresponseheaderreceivedurationms”: 167,
“originresponsehttpexpires”: “”,
“originresponsehttplastmodified”: “”,
“originresponsetime”: 168000000,
“origintcphandshakedurationms”: 0,
“origintlshandshakedurationms”: 0,
“parentrayid”: “00",
“smartroutecoloid”: 12,
“uppertiercoloid”: 0,
}
h121h
12:07 AMh121h
12:08 AMPrabhat
12:09 AM1
Prabhat
12:12 AMPrabhat
12:12 AMselect ja3hash, count(*) from logstream where edgecolocode = 'SJC' group by ja3hash
Prabhat
12:12 AMPrabhat
12:13 AMh121h
12:14 AMh121h
12:14 AM1
h121h
12:15 AMPrabhat
12:18 AMselect ja3hash, count(*) as counter from logstream where edgecolocode = 'SJC' group by ja3hash order by counter desc
h121h
12:19 AMOpenObserve
Indexed 406 threads (74% resolved)
Similar Threads
Discussing Cast/Schema Extension in 0.4.8 Update.
Mark inquired about a casting issue from 0.4.8 version, Prabhat suggested a workaround involving an environment variable, yet this didn't resolve the issue completely. Ashish recommended testing with a different dev image.
Troubleshooting Zincobserve Upload Error
Simon encountered a 500 error when uploading logs to Zincobserve. Hengfei suggested using `--data-binary "@demo.log"` instead of `-d`, which resolved the issue.
Issues with openobserve(v0.5.0) API Response Code
Shashank is facing issues with an API call getting a bad response code. Hengfei indicated the query may be incorrect and suggested an upgrade. Prabhat showed typical stream page queries. The issue is unresolved.
Erroneous Triggering of Alarm in 0.5.1
Chris expressed experiencing occasional erroneous alerts trigger on a specific stream query. Ashish suggested the issue might be linked to a known duplicates bug. Uncertain, Chris decided to monitor the issue further and report if it persists.
ZO Kubernetes Issues: Query Log Error and Adding Users
Sa had issues with querying logs in ZO on Kubernetes and creating users. Hengfei provided solutions for both problems, including updating with a dev version and setting memory cache values.