How to filter on one field but include other fields in result

InfluxDB 2 Dashboards
, ,
1

Hello,

how to filter following data where topics includes “account”:

[
  {
    "host": "telegraf",
    "message": "package channel changed by winbox-3.41/mac-msg(winbox):admin@[MAC] (/system package update set channel=testing)",
    "topics": "system,info",
    "time": "2024-08-06T19:19:30.144379267Z"
  },
  {
    "host": "telegraf",
    "message": "package channel changed by winbox-3.41/mac-msg(winbox):admin@[MAC] (/system package update set channel=stable)",
    "topics": "system,info",
    "time": "2024-08-06T19:19:30.144402187Z"
  },
  {
    "host": "telegraf",
    "message": "user admin logged out from [MAC] via winbox",
    "topics": "system,info,account",
    "time": "2024-08-06T19:19:30.144408939Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -62",
    "topics": "wireless,info",
    "time": "2024-08-06T19:19:30.144423912Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -61",
    "topics": "wireless,info",
    "time": "2024-08-06T19:24:04.303321525Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 connected, signal strength -58",
    "topics": "wireless,info",
    "time": "2024-08-06T19:27:07.026508692Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -59",
    "topics": "wireless,info",
    "time": "2024-08-06T19:32:07.925011338Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 connected, signal strength -58",
    "topics": "wireless,info",
    "time": "2024-08-06T19:33:44.969242904Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -62",
    "topics": "wireless,info",
    "time": "2024-08-06T19:38:57.649835972Z"
  }
]

I tried the following:

import "strings"

from(bucket: "myBucket")
  |> range(start: -1d)
  |> filter(fn: (r) => contains(set: ["topics", "message"], value: r._field))
  |> filter(fn: (r) => strings.containsStr(v: r._value, substr: "account") == true)

then I only get the where topics and message includes “account”, but I want to filter only topics and want to see the message which has the topic included. Anyone know my mistake? I think Im doing something heavily wrong :smiley:

2

Hello @Evolutio,
Omg bless your heart for giving me an array so I can reproduce easily over here :slight_smile:
Let’s see what I can do :slight_smile:

This works for me:

import "array"
import "strings"

data = 
[
  {
    "host": "telegraf",
    "message": "package channel changed by winbox-3.41/mac-msg(winbox):admin@[MAC] (/system package update set channel=testing)",
    "topics": "system,info",
    "time": "2024-08-06T19:19:30.144379267Z"
  },
  {
    "host": "telegraf",
    "message": "package channel changed by winbox-3.41/mac-msg(winbox):admin@[MAC] (/system package update set channel=stable)",
    "topics": "system,info",
    "time": "2024-08-06T19:19:30.144402187Z"
  },
  {
    "host": "telegraf",
    "message": "user admin logged out from [MAC] via winbox",
    "topics": "system,info,account",
    "time": "2024-08-06T19:19:30.144408939Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -62",
    "topics": "wireless,info",
    "time": "2024-08-06T19:19:30.144423912Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -61",
    "topics": "wireless,info",
    "time": "2024-08-06T19:24:04.303321525Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 connected, signal strength -58",
    "topics": "wireless,info",
    "time": "2024-08-06T19:27:07.026508692Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -59",
    "topics": "wireless,info",
    "time": "2024-08-06T19:32:07.925011338Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 connected, signal strength -58",
    "topics": "wireless,info",
    "time": "2024-08-06T19:33:44.969242904Z"
  },
  {
    "host": "telegraf",
    "message": "[MAC]@cap-wifi5 disconnected, connection lost, signal strength -62",
    "topics": "wireless,info",
    "time": "2024-08-06T19:38:57.649835972Z"
  }
]

array.from(rows: data)
|> filter(fn: (r) => strings.containsStr(v: r.topics, substr: "account") == true)

Is that the only issue? Calling the right column instead of _value?

3

thanks for you reply.

The array is the result I got over the influxdb2 rust client.

When I try your solution in the influxdb2 data explorer I got the following:

image
image1259×611 23.7 KB

When I only select all Data filtered on topics and message, the result looks like this:

image
image1710×762 98.8 KB