TLDR Ted experiences OOM error while using VRL Function queries, leading to queries failing. Ashish helps to troubleshoot and suggests implementing VRL-functions during a narrower query time window. They also give specific codes to remove unused field names and in return Ted manages to resolve the error.
are you trying function at query time?
if yes and if you are trying it on hugh amount of data..it can cause OOM
No, I just enter one dot. " . "
yes it can cause OOM
try removing .
and querying
what are trying to achieve with vrl?
I'm trying to learn VRL Function. I want to remove_unused_k8s_fileds like in pic (from
what we suggest is use vrl functions during query time on small data ..by keeping time window to 1 min etc
del(._p) del(.kubernetes_container_hash) del(.kubernetes_docker_id) del(.kubernetes_pod_id) del(.kubernetes_labels_pod_template_hash) del(.kubernetes_annotations_checksum_luascripts) del(.kubernetes_annotations_checksum_config) .
you can try above code snippet with appropriate field names to remove unused fields
once you finzalize your function
associate it with steam so that function works at data ingestion
check this video
ok, I try with 1min frame and it's working now. Thank you!
I just read docs at
yes these should work..as long as you have appropriate data
Yay, thank you so much!
welcome
Hi, can I ask 1 more question. I want to parse this log to the table. What function do I need to parse it?
check if this helps
you can use
yes, thank you! :pray:
Ted
Tue, 31 Oct 2023 08:46:33 UTCHi, I just try VRL Function with dot ' . ' (see the pic) , querier pod got OOMKilled immediately. I install HA Deployment on k8s via helm chart without any resource limit configure. Is it issue of VRL function? Node pool: 2 CPU 16G Ram