Table Widget

The Table widget displays data in rows and columns. Although the result of any LogScale query can be displayed in a table, this is best used with output that has a limited and predefined number of fields — unlike for instance raw events which can produce a huge number of columns and slow down the UI.

See in Figure 168, “Table Chart” an example of how this widget looks like.

Table Chart

Figure 168. Table Chart


Input Format

The Table widget is best used with aggregate functions like groupBy() or table(). The table() can help sort the columns since fields and columns will be displayed in the order that they are provided to the function.

Example: A List of Common Errors

Assume we have a service producing logs like the ones below:

ini
2018-10-10T01:10:11.322Z [ERROR] Invalid User ID. errorID=2, userId=10
2018-10-10T01:10:12.172Z [WARN]  Low Disk Space.
2018-10-10T01:10:14.122Z [ERROR] Invalid User ID. errorID=2, userId=11
2018-10-10T01:10:15.312Z [ERROR] Connection Dropped. errorID=112 server=120.100.121.12
2018-10-10T01:10:16.912Z [INFO]  User Login. userId=11

We want to figure out which errors occur most often and show them in a table on one of our dashboards.

We can do a query like:

logscale
loglevel = ERROR |
groupBy(errorID, function=[count(as=Count), collect(message)]) |
rename(errorID, as="Error ID") |
table(["Error ID", message])

counting the number of errors bucketed by their errorId. To show a human readable message in the table and not just the ID, we include the function collect() which ensures that the value of the message field makes it through the groupBy phase (which otherwise only includes the series field (errorId) and the result of the aggregate function (Count)).

Since we want our table to look nice on the dashboard, we rename the errorID field to Error ID as this will be the header in our table.

Finally, we use the table() function to ensure the order of the columns.

Widget Properties

Use the widget's Edit Style panel to configure the following properties.

  • Title

    The title of the widget as displayed in the dashboard.

  • Description

    The description of the table. This is free form text supporting markdown syntax. Notice in the example Figure 168, “Table Chart” that the description appears in the dashboard as a tooltip when hovering over the question mark on top of the widget.