Hi Team,
We have recently upgrade to Grafana-v10.0.3 and were exploring the correlations feature ( though this is a public preview). We defined few correlations against few existing fields of the logs but they are not showing up anywhere ( only traceid link is shown which is already defined as derived variable in loki data source). Can some one please guide what I am missing or any other configuration that needs to be taken care. TIA:pray:
How we have defined.
Note - we also tried putting logfmt and regular expressions for field search but none seems working.
on step 2 of the editor, where you define the target, do you use a variable like ${namespace} ?
I’m one of the developers on correlations btw, I’m super thrilled youre trying it out. We know the current correlations editor is harder to use, we have a big upgrade in the works for it, but I appreciate you sticking with what we have
One way to check is to have the target datasource be the test data datasource. Have the scenario be CSV Content, then have the only content be ${namespace} in this instance. You should see the datalink, and the button will pull up test data with just that value
> on step 2 of the editor, where you define the target, do you use a variable like ${namespace}
No. we have been trying with putting the field name directly. let me try it out too.
Update
Tried with testdata data source ( with log as source). Sample log line is:
t=2023-09-07T11:11:44Z lvl=trace msg="Request Completed" logger=context userId=1 orgId=1 uname=admin method=GET path=/api/datasources/proxy/152/api/prom/label status=502 remote_addr=[::1] time_ms=1 size=0 referer="<http://localhost:3000/explore?left=%5B%22now-6h%22,%22now%22,%22Prometheus%202.x%22,%7B%7D,%7B%22ui%22:%5Btrue,true,true,%22none%22%5D%7D%5D>"
and tried with all possible combination of defining the target ( no transformation, Transformation with regex and transformation with logfmt). Also tried various ways of defining the results field but none seems working and not reflected as data link anywhere in the logs. A sample snippet out of many tries:
What does your step 2 look like?
I think the complicated part with here is parsing the log line - the field that the actual log line is on can be tough to dig out. You can find it by going to Query Inspector > Data. For the test data, logs scenario, the field the log line is in is named message
So because this line can be parsed with logfmt, you just need that transformation
The source can just use the key of the parsed log line
If it’s a field outside the log line, like your original example with namespace , you shouldnt need any transformation. Using ${namespace} in step 2 should work
Thanks . Seems like it worked and link is showing up. 
Though i need to fine tune the regex and parse the json field further. Thank you! Really appreciate your support.
Thank you for sticking with it
