I am using Grafana for visualizing my logs and came across a specific challenge related to handling special characters, specifically the square brackets ([...]).
Situation:
In one of my dashboards, I have messages like: ERROR: DoorBoard: SetErrorClass[Uart]: Connection timeout. The key segment here is [Uart].
To navigate to a detailed dashboard, I use the link: https://localhost:8443/d/mxQsIYaVk/inspect-promtail-log-details?orgId=1&from=now-7d&to=now&var-errorMsg=${__data.fields.message}. This sets a Grafana variable, errorMsg, to the clicked message.
In the detailed dashboard, I then use the query: {job="systemd-journal"} |~ .$errorMsg.| regexp(?PERROR:.*?)(\x1B[0m|\x1B[m|$)`` to filter logs based on this variable.
Problem:
When the message contains "[...]", it causes issues with the regex interpretation. For instance, "\[...\]" works perfectly. However, I am unsure about the best way to modify the variable or representation to handle this correctly.
Currently, I am considering a method to replace patterns within a Grafana variable, so the message "ERROR: Bill: SetErrorClass[SerialPort]: SYNC failed" would appear as "ERROR: Bill: SetErrorClass\[SerialPort\]: SYNC failed", thus making the variable play nicely with regex in the subsequent dashboard. But I haven't found a way to perform this transformation in Grafana.
Is there a way in Grafana to replace certain patterns within a variable? Or is there a different approach to sidestep this issue, perhaps at the regex level or another stage?