Filtering logs based on text inside log message

[Nipun Kanade]

I have enabled `log_duration` flag in my cloud sql db. I'm getting the following logs 

2019-06-28 08:27:49.108 CLT[3760521]: [67080-1] db=*****-psql,user=***-user LOG: duration: 0.060 ms 

Based on this I was able to create a log-based metric extracting out the duration, and also I was able to create a beautiful chart showing how the queries are performing.

I see a few queries that are taking time and hence in the stack-driver I wanted to see the logs of queries that are exceeding 1000ms

how can I filter out such logs. I don't see a regex filter on the advanced filters.

[Nipun Kanade]

Hi, is this not possible as of today? Is there any way to do it? 

No reply on this is concerning.. 

--
© 2016 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
 
Email preferences: You received this email because you signed up for the Google Stackdriver Discussion Google Group (google-stackdr...@googlegroups.com) to participate in discussions with other members of the GoogleStackdriver community.
---
You received this message because you are subscribed to the Google Groups "Google Stackdriver Discussion Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-stackdriver-d...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-stackdriver-discussion/518829a5-8a99-4b43-8677-3c3fe05a549c%40googlegroups.com.

--

Nipun Kanade
+91-9977893993

[Mary Koes]

Hey and apologies on the slow response.  We were brainstorming ideas but hadn't closed the loop here.  Our recommendation would be to have fluentd parse out the "duration" string and add it as an integer user label which could then be queried using standard integer inequalities.  Otherwise, we just support text search today within log entries so while you could find all the entries with 1ms+ with something like the following query, that wouldn't solve the problem of finding everything with 1000ms+.

textPayload: "duration:" AND NOT textPayload: "duration: 0"

Best,

Mary

To view this discussion on the web visit https://groups.google.com/d/msgid/google-stackdriver-discussion/CACqa7RQE2R1A4AbudiB20JPxvit7FENcQfJ4JNuixd1pT6FDmQ%40mail.gmail.com.