[{"data":1,"prerenderedAt":1788},["ShallowReactive",2],{"\u002Ffeatures\u002Flogs\u002Fgrouping-navigation":3,"\u002Ffeatures\u002Flogs\u002Fgrouping":116},[4,8,28,38,52,56,60,70,74,78,82,86,90,94,98],{"title":5,"path":6,"stem":7},"Get started","\u002Ffeatures","features\u002Findex",{"title":9,"closed":10,"path":11,"stem":12,"children":13,"page":-1},"Traces",true,"\u002Ffeatures\u002Ftraces","features\u002F01.traces\u002Findex",[14,16,20,24],{"title":15,"path":11,"stem":12},"Introduction",{"title":17,"path":18,"stem":19},"Grouping & systems","\u002Ffeatures\u002Ftraces\u002Fgrouping","features\u002F01.traces\u002Fgrouping",{"title":21,"path":22,"stem":23},"Querying spans","\u002Ffeatures\u002Ftraces\u002Fquerying-spans","features\u002F01.traces\u002Fquerying-spans",{"title":25,"path":26,"stem":27},"Querying traces","\u002Ffeatures\u002Ftraces\u002Fquerying-traces","features\u002F01.traces\u002Fquerying-traces",{"title":29,"closed":10,"path":30,"stem":31,"children":32,"page":-1},"Logs","\u002Ffeatures\u002Flogs","features\u002F02.logs\u002Findex",[33,34],{"title":15,"path":30,"stem":31},{"title":35,"path":36,"stem":37},"Grouping rules","\u002Ffeatures\u002Flogs\u002Fgrouping","features\u002F02.logs\u002Fgrouping",{"title":39,"closed":10,"path":40,"stem":41,"children":42,"page":-1},"Metrics","\u002Ffeatures\u002Fmetrics","features\u002F03.metrics\u002Findex",[43,44,48],{"title":15,"path":40,"stem":41},{"title":45,"path":46,"stem":47},"Querying","\u002Ffeatures\u002Fmetrics\u002Fquerying","features\u002F03.metrics\u002F02.querying",{"title":49,"path":50,"stem":51},"PromQL compat","\u002Ffeatures\u002Fmetrics\u002Fpromql-compat","features\u002F03.metrics\u002F03.promql-compat",{"title":53,"path":54,"stem":55},"Alerts and Notifications","\u002Ffeatures\u002Falerting","features\u002F04.alerting",{"title":57,"path":58,"stem":59},"Chart annotations","\u002Ffeatures\u002Fannotations","features\u002F05.annotations",{"title":61,"path":62,"stem":63,"children":64,"closed":10},"Dashboards","\u002Ffeatures\u002Fdashboards","features\u002F06.dashboards\u002F1.index",[65,66],{"title":61,"path":62,"stem":63},{"title":67,"path":68,"stem":69},"YAML Templates","\u002Ffeatures\u002Fdashboards\u002Fyaml","features\u002F06.dashboards\u002F2.yaml",{"title":71,"path":72,"stem":73},"Transformations","\u002Ffeatures\u002Ftransformations","features\u002F07.transformations",{"title":75,"path":76,"stem":77},"Service graph","\u002Ffeatures\u002Fservice-graph","features\u002F08.service-graph",{"title":79,"path":80,"stem":81},"Grafana integration","\u002Ffeatures\u002Fgrafana","features\u002F09.grafana",{"title":83,"path":84,"stem":85},"Data fixtures","\u002Ffeatures\u002Ffixtures","features\u002F10.fixtures",{"title":87,"path":88,"stem":89},"JavaScript Source Maps","\u002Ffeatures\u002Fsourcemaps","features\u002F11.sourcemaps",{"title":91,"path":92,"stem":93},"MCP Server","\u002Ffeatures\u002Fmcp","features\u002F12.mcp",{"title":95,"path":96,"stem":97},"Searching","\u002Ffeatures\u002Fsearching","features\u002F4.searching",{"title":99,"closed":10,"path":100,"stem":101,"children":102,"page":115},"SSO","\u002Ffeatures\u002Fsso","features\u002Fsso",[103,107,111],{"title":104,"path":105,"stem":106},"Google","\u002Ffeatures\u002Fsso\u002Fgoogle","features\u002Fsso\u002F1.google",{"title":108,"path":109,"stem":110},"Okta","\u002Ffeatures\u002Fsso\u002Fokta","features\u002Fsso\u002F2.okta",{"title":112,"path":113,"stem":114},"Keycloak","\u002Ffeatures\u002Fsso\u002Fkeycloak","features\u002Fsso\u002F3.keycloak",false,{"page":117,"surround":1783},{"id":118,"title":35,"body":119,"description":1772,"extension":1773,"image":1774,"meta":1775,"navigation":10,"path":36,"seo":1781,"stem":37,"surround_disabled":115,"__hash__":1782},"features\u002Ffeatures\u002F02.logs\u002Fgrouping.md",{"type":120,"value":121,"toc":1745},"minimark",[122,126,129,140,145,153,158,161,167,171,178,184,188,191,197,204,210,217,223,227,234,282,286,292,298,351,358,454,461,467,473,491,505,509,516,522,532,536,543,549,552,558,569,583,601,604,610,619,623,630,694,697,813,817,924,928,1052,1056,1224,1228,1279,1283,1446,1450,1453,1522,1526,1535,1538,1544,1551,1557,1564,1691,1695,1698,1704,1707,1712,1715,1721,1725,1741],[123,124,125],"p",{},"Grouping rules let you change how Uptrace groups logs and exceptions together. Each rule is a Grok-style pattern: literal words plus typed placeholders that extract variable parts (numbers, IPs, identifiers, etc.) and feed them into the grouping fingerprint.",[123,127,128],{},"For example, you can configure Uptrace to create a separate error group for each unknown PostgreSQL column:",[130,131,136],"pre",{"className":132,"code":134,"language":135},[133],"language-text","# Error messages\nERROR: column \"event.created_at\" does not exist (SQLSTATE=42703)\nERROR: column \"updated_at\" does not exist (SQLSTATE=42703)\nERROR: column \"name\" does not exist (SQLSTATE=42703)\n\n# Pattern\n%{LOG_LEVEL:log_severity} column %{QUOTED:#column} does not exist %{ATTR:sqlstate}\n","text",[137,138,134],"code",{"__ignoreMap":139},"",[141,142,144],"h2",{"id":143},"patterns","Patterns",[123,146,147,148,152],{},"A pattern is a sequence of ",[149,150,151],"strong",{},"matchers"," separated by whitespace. Each matcher is either a literal word or a typed placeholder.",[154,155,157],"h3",{"id":156},"literals","Literals",[123,159,160],{},"Plain words match tokens exactly:",[130,162,165],{"className":163,"code":164,"language":135},[133],"error connecting to database\n",[137,166,164],{"__ignoreMap":139},[154,168,170],{"id":169},"typed-placeholders","Typed placeholders",[123,172,173,174,177],{},"Typed placeholders use Grok syntax ",[137,175,176],{},"%{TYPE}"," to match variable tokens by type:",[130,179,182],{"className":180,"code":181,"language":135},[133],"%{NUMBER}\n%{IP}\n%{LOG_LEVEL}\n",[137,183,181],{"__ignoreMap":139},[154,185,187],{"id":186},"capture-name","Capture name",[123,189,190],{},"Add a capture name after a colon to extract the matched value into an attribute:",[130,192,195],{"className":193,"code":194,"language":135},[133],"%{NUMBER:status_code}\n%{IP:remote_addr}\n",[137,196,194],{"__ignoreMap":139},[123,198,199,200,203],{},"Prefix the capture name with ",[137,201,202],{},"#"," to also include the matched value in the grouping fingerprint hash. This is how you create a separate group per unique value:",[130,205,208],{"className":206,"code":207,"language":135},[133],"%{IDENT:#function_name}\n",[137,209,207],{"__ignoreMap":139},[123,211,212,213,216],{},"Without a capture name, use the ",[137,214,215],{},"fingerprint"," option instead:",[130,218,221],{"className":219,"code":220,"language":135},[133],"%{IDENT,fingerprint}\n",[137,222,220],{"__ignoreMap":139},[154,224,226],{"id":225},"primary-constraint","Primary constraint",[123,228,229,230,233],{},"The parenthesized argument ",[137,231,232],{},"%{TYPE(arg)}"," constrains which tokens match. Its meaning depends on the type:",[235,236,237,250],"ul",{},[238,239,240,243,244],"li",{},[149,241,242],{},"Value constraint"," (most types): match only tokens with this exact value.",[130,245,248],{"className":246,"code":247,"language":135},[133],"%{LOG_LEVEL(ERROR)}\n%{LOG_LEVEL(ERROR):level}\n",[137,249,247],{"__ignoreMap":139},[238,251,252,255,256,259,260,263,264,267,268,271,272,275,276],{},[149,253,254],{},"Key constraint"," (",[137,257,258],{},"ATTR","): match only ",[137,261,262],{},"key=value"," tokens whose key equals the argument. The key auto-captures, so ",[137,265,266],{},"%{ATTR(status)}"," is equivalent to ",[137,269,270],{},"%{ATTR(status):status}",". Use ",[137,273,274],{},"_"," to suppress auto-capture.",[130,277,280],{"className":278,"code":279,"language":135},[133],"%{ATTR(status)}\n%{ATTR(user_id):var}\n%{ATTR(status):_}\n",[137,281,279],{"__ignoreMap":139},[154,283,285],{"id":284},"options","Options",[123,287,288,289,291],{},"Options are comma-separated ",[137,290,262],{}," pairs after the capture name:",[130,293,296],{"className":294,"code":295,"language":135},[133],"%{NUMBER:duration,unit=seconds}\n",[137,297,295],{"__ignoreMap":139},[299,300,301,314],"table",{},[302,303,304],"thead",{},[305,306,307,311],"tr",{},[308,309,310],"th",{},"Option",[308,312,313],{},"Description",[315,316,317,328,337],"tbody",{},[305,318,319,325],{},[320,321,322],"td",{},[137,323,324],{},"unit",[320,326,327],{},"Attach a unit to numeric values for normalization",[305,329,330,334],{},[320,331,332],{},[137,333,215],{},[320,335,336],{},"Include the matched value in the grouping fingerprint hash (no value)",[305,338,339,344],{},[320,340,341],{},[137,342,343],{},"extract",[320,345,346,347,350],{},"Backtick-quoted Go regex applied to a ",[137,348,349],{},"%{QUOTED}"," token; named groups become captures",[123,352,353,354,357],{},"Supported units (used with ",[137,355,356],{},"unit=...","):",[235,359,360,390,425],{},[238,361,362,365,366,369,370,255,373,376,377,255,380,376,383,255,386,389],{},[149,363,364],{},"Time:"," ",[137,367,368],{},"nanoseconds",", ",[137,371,372],{},"microseconds",[137,374,375],{},"us","), ",[137,378,379],{},"milliseconds",[137,381,382],{},"ms",[137,384,385],{},"seconds",[137,387,388],{},"s",")",[238,391,392,365,395,255,398,376,401,255,404,376,407,255,410,376,413,255,416,376,419,255,422,389],{},[149,393,394],{},"Storage:",[137,396,397],{},"bytes",[137,399,400],{},"by",[137,402,403],{},"kilobytes",[137,405,406],{},"kb",[137,408,409],{},"megabytes",[137,411,412],{},"mb",[137,414,415],{},"gigabytes",[137,417,418],{},"gb",[137,420,421],{},"terabytes",[137,423,424],{},"tb",[238,426,427,365,430,255,433,376,436,369,439,369,442,369,445,369,448,369,451],{},[149,428,429],{},"Other:",[137,431,432],{},"percents",[137,434,435],{},"%",[137,437,438],{},"count",[137,440,441],{},"celsius",[137,443,444],{},"volts",[137,446,447],{},"amperes",[137,449,450],{},"joules",[137,452,453],{},"grams",[154,455,457,458,460],{"id":456},"regex-extraction-extract-option","Regex extraction (",[137,459,343],{}," option)",[123,462,463,464,466],{},"On ",[137,465,349],{}," matchers you can supply a Go regex in backticks. Named groups in the regex become additional captures at runtime:",[130,468,471],{"className":469,"code":470,"language":135},[133],"ERROR %{QUOTED:msg,extract=`(?P\u003Cname>\\w+) is (?P\u003Cage>\\d+)`}\n",[137,472,470],{"__ignoreMap":139},[123,474,475,476,479,480,369,483,486,487,490],{},"Given the log line ",[137,477,478],{},"ERROR \"Alice is 25\"",", this rule captures ",[137,481,482],{},"msg=Alice is 25",[137,484,485],{},"name=Alice",", and ",[137,488,489],{},"age=25",".",[123,492,493,494,497,498,500,501,504],{},"If the regex does not match the quoted token, the rule still fires and the outer ",[137,495,496],{},":capture"," is still recorded, but no extra attributes are emitted. Optional named groups that do not participate in a match are not emitted as empty attributes. If a named group collides with the matcher's own ",[137,499,496],{}," or another attribute key, a numeric suffix is appended (e.g., the second value becomes ",[137,502,503],{},"name1",").",[154,506,508],{"id":507},"optional-matchers","Optional matchers",[123,510,511,512,515],{},"Append ",[137,513,514],{},"?"," to make a matcher optional — the pattern still matches if the token is absent:",[130,517,520],{"className":518,"code":519,"language":135},[133],"error code %{NUMBER:code}? occurred\n",[137,521,519],{"__ignoreMap":139},[123,523,524,525,528,529,490],{},"This matches both ",[137,526,527],{},"error code 500 occurred"," and ",[137,530,531],{},"error code occurred",[154,533,535],{"id":534},"groups-and-alternatives","Groups and alternatives",[123,537,538,539,542],{},"Parentheses define a group of alternatives separated by ",[137,540,541],{},"|",":",[130,544,547],{"className":545,"code":546,"language":135},[133],"(%{LOG_LEVEL:level}|%{WORD:level}) %{WORD:msg}\n",[137,548,546],{"__ignoreMap":139},[123,550,551],{},"Groups themselves can be optional:",[130,553,556],{"className":554,"code":555,"language":135},[133],"(%{LOG_LEVEL})?\n",[137,557,555],{"__ignoreMap":139},[154,559,561,562,565,566,389],{"id":560},"repeat-matchers-any-any","Repeat matchers (",[137,563,564],{},"%{ANY}+"," \u002F ",[137,567,568],{},"%{ANY}*",[123,570,511,571,574,575,578,579,582],{},[137,572,573],{},"+"," or ",[137,576,577],{},"*"," to ",[137,580,581],{},"%{ANY}"," to match multiple tokens of any type:",[235,584,585,594],{},[238,586,587,589,590,593],{},[137,588,564],{}," matches ",[149,591,592],{},"one or more"," tokens.",[238,595,596,589,598,593],{},[137,597,568],{},[149,599,600],{},"zero or more",[123,602,603],{},"Repeat matchers work anywhere in a pattern:",[130,605,608],{"className":606,"code":607,"language":135},[133],"error %{WORD:action} %{ANY:details}+ matches \"error connect failed with timeout\"\nfoo %{ANY:mid}+ bar matches \"foo x y z bar\"\n%{IDENT:function} failed %{ANY}+ matches \"myFunc failed with status 500\"\n",[137,609,607],{"__ignoreMap":139},[123,611,612,613,615,616,618],{},"Repeat is only valid on ",[137,614,581],{},". It cannot be combined with a value constraint or a ",[137,617,324],{}," option.",[141,620,622],{"id":621},"available-types","Available types",[123,624,625,626,629],{},"Some types are ",[149,627,628],{},"virtual"," — they expand to several concrete types.",[299,631,632,642],{},[302,633,634],{},[305,635,636,639],{},[308,637,638],{},"Virtual",[308,640,641],{},"Expands to",[315,643,644,654,664,674,684],{},[305,645,646,651],{},[320,647,648],{},[137,649,650],{},"ANY",[320,652,653],{},"Any single token, regardless of type",[305,655,656,661],{},[320,657,658],{},[137,659,660],{},"NUMBER",[320,662,663],{},"INT, FLOAT, BYTE_SIZE, TRACE_ID_HEX",[305,665,666,671],{},[320,667,668],{},[137,669,670],{},"IP",[320,672,673],{},"IPV4, IPV6",[305,675,676,681],{},[320,677,678],{},[137,679,680],{},"IDENT",[320,682,683],{},"WORD, IDENT",[305,685,686,691],{},[320,687,688],{},[137,689,690],{},"TIMESTAMP",[320,692,693],{},"ISO8601_DATE, UNIX_DATE, HTTP_DATE, SYSLOG_DATE, DATETIME",[154,695,696],{"id":135},"Text",[299,698,699,711],{},[302,700,701],{},[305,702,703,706,708],{},[308,704,705],{},"Type",[308,707,313],{},[308,709,710],{},"Example",[315,712,713,731,751,769,787],{},[305,714,715,720,723],{},[320,716,717],{},[137,718,719],{},"WORD",[320,721,722],{},"A single alphabetical word",[320,724,725,369,728],{},[137,726,727],{},"error",[137,729,730],{},"database",[305,732,733,737,740],{},[320,734,735],{},[137,736,680],{},[320,738,739],{},"An identifier",[320,741,742,369,745,369,748],{},[137,743,744],{},"user_id",[137,746,747],{},"MyClass",[137,749,750],{},"obj.attr",[305,752,753,758,761],{},[320,754,755],{},[137,756,757],{},"QUOTED",[320,759,760],{},"A quoted string",[320,762,763,369,766],{},[137,764,765],{},"\"hello world\"",[137,767,768],{},"'foo'",[305,770,771,776,779],{},[320,772,773],{},[137,774,775],{},"UNKNOWN",[320,777,778],{},"An unclassified segment (lexer fallback when no other type matches)",[320,780,781,369,784],{},[137,782,783],{},"??!!",[137,785,786],{},"\\x1b[0m",[305,788,789,793,802],{},[320,790,791],{},[137,792,650],{},[320,794,795,796,798,799,801],{},"Any single token. With ",[137,797,573],{},": one or more tokens. With ",[137,800,577],{},": zero or more tokens.",[320,803,804,369,807,369,810],{},[137,805,806],{},"42",[137,808,809],{},"GET",[137,811,812],{},"foo",[154,814,816],{"id":815},"numeric","Numeric",[299,818,819,829],{},[302,820,821],{},[305,822,823,825,827],{},[308,824,705],{},[308,826,313],{},[308,828,710],{},[315,830,831,850,868,888,908],{},[305,832,833,837,840],{},[320,834,835],{},[137,836,660],{},[320,838,839],{},"Any numeric (INT, FLOAT, BYTE_SIZE, TRACE_ID_HEX)",[320,841,842,369,844,369,847],{},[137,843,806],{},[137,845,846],{},"3.14",[137,848,849],{},"10KB",[305,851,852,857,860],{},[320,853,854],{},[137,855,856],{},"INT",[320,858,859],{},"Integer",[320,861,862,369,865],{},[137,863,864],{},"200",[137,866,867],{},"-17",[305,869,870,875,878],{},[320,871,872],{},[137,873,874],{},"FLOAT",[320,876,877],{},"Floating-point number",[320,879,880,369,882,369,885],{},[137,881,846],{},[137,883,884],{},"-0.5",[137,886,887],{},"1e9",[305,889,890,895,898],{},[320,891,892],{},[137,893,894],{},"BYTE_SIZE",[320,896,897],{},"Byte size with unit",[320,899,900,369,902,369,905],{},[137,901,849],{},[137,903,904],{},"2.5MiB",[137,906,907],{},"512B",[305,909,910,915,918],{},[320,911,912],{},[137,913,914],{},"TRACE_ID_HEX",[320,916,917],{},"32-character hex string",[320,919,920,923],{},[137,921,922],{},"5d41402abc4b2a76b9719d911017c592"," (MD5)",[154,925,927],{"id":926},"network","Network",[299,929,930,940],{},[302,931,932],{},[305,933,934,936,938],{},[308,935,705],{},[308,937,313],{},[308,939,710],{},[315,941,942,959,974,989,1007,1022,1037],{},[305,943,944,948,951],{},[320,945,946],{},[137,947,670],{},[320,949,950],{},"IPV4 or IPV6 (virtual)",[320,952,953,369,956],{},[137,954,955],{},"127.0.0.1",[137,957,958],{},"::1",[305,960,961,966,969],{},[320,962,963],{},[137,964,965],{},"IPV4",[320,967,968],{},"IPV4 address",[320,970,971],{},[137,972,973],{},"192.168.1.1",[305,975,976,981,984],{},[320,977,978],{},[137,979,980],{},"IPV6",[320,982,983],{},"IPV6 address",[320,985,986],{},[137,987,988],{},"2001:db8::1",[305,990,991,996,1002],{},[320,992,993],{},[137,994,995],{},"HOST_PORT",[320,997,998,1001],{},[137,999,1000],{},"host:port"," combination",[320,1003,1004],{},[137,1005,1006],{},"10.0.0.1:443",[305,1008,1009,1014,1017],{},[320,1010,1011],{},[137,1012,1013],{},"MAC",[320,1015,1016],{},"MAC address",[320,1018,1019],{},[137,1020,1021],{},"00:1A:2B:3C:4D:5E",[305,1023,1024,1029,1032],{},[320,1025,1026],{},[137,1027,1028],{},"EMAIL",[320,1030,1031],{},"Email address",[320,1033,1034],{},[137,1035,1036],{},"admin@example.com",[305,1038,1039,1044,1047],{},[320,1040,1041],{},[137,1042,1043],{},"URI",[320,1045,1046],{},"Full URI",[320,1048,1049],{},[137,1050,1051],{},"https:\u002F\u002Fexample.com\u002Fapi\u002Fv1",[154,1053,1055],{"id":1054},"temporal","Temporal",[299,1057,1058,1068],{},[302,1059,1060],{},[305,1061,1062,1064,1066],{},[308,1063,705],{},[308,1065,313],{},[308,1067,710],{},[315,1069,1070,1084,1098,1113,1128,1143,1158,1173,1188,1206],{},[305,1071,1072,1076,1079],{},[320,1073,1074],{},[137,1075,690],{},[320,1077,1078],{},"Any timestamp format (virtual)",[320,1080,1081],{},[137,1082,1083],{},"2024-01-15T14:30:00Z",[305,1085,1086,1091,1094],{},[320,1087,1088],{},[137,1089,1090],{},"ISO8601_DATE",[320,1092,1093],{},"ISO8601 \u002F RFC3339",[320,1095,1096],{},[137,1097,1083],{},[305,1099,1100,1105,1108],{},[320,1101,1102],{},[137,1103,1104],{},"UNIX_DATE",[320,1106,1107],{},"Unix date",[320,1109,1110],{},[137,1111,1112],{},"Mon Jan 2 15:04:05 MST 2006",[305,1114,1115,1120,1123],{},[320,1116,1117],{},[137,1118,1119],{},"HTTP_DATE",[320,1121,1122],{},"HTTP log date",[320,1124,1125],{},[137,1126,1127],{},"21\u002FNov\u002F2024:14:20:00 +0000",[305,1129,1130,1135,1138],{},[320,1131,1132],{},[137,1133,1134],{},"SYSLOG_DATE",[320,1136,1137],{},"Syslog timestamp",[320,1139,1140],{},[137,1141,1142],{},"Jan 2 15:04:05",[305,1144,1145,1150,1153],{},[320,1146,1147],{},[137,1148,1149],{},"DATETIME",[320,1151,1152],{},"Date and time",[320,1154,1155],{},[137,1156,1157],{},"2024-01-15 14:30:00",[305,1159,1160,1165,1168],{},[320,1161,1162],{},[137,1163,1164],{},"DATE",[320,1166,1167],{},"Date only",[320,1169,1170],{},[137,1171,1172],{},"2024-01-15",[305,1174,1175,1180,1183],{},[320,1176,1177],{},[137,1178,1179],{},"TIME",[320,1181,1182],{},"Time of day",[320,1184,1185],{},[137,1186,1187],{},"14:30:00",[305,1189,1190,1195,1198],{},[320,1191,1192],{},[137,1193,1194],{},"MONTH_NAME",[320,1196,1197],{},"Month name",[320,1199,1200,369,1203],{},[137,1201,1202],{},"Jan",[137,1204,1205],{},"February",[305,1207,1208,1213,1216],{},[320,1209,1210],{},[137,1211,1212],{},"WEEKDAY",[320,1214,1215],{},"Day-of-week name",[320,1217,1218,369,1221],{},[137,1219,1220],{},"Mon",[137,1222,1223],{},"Tuesday",[154,1225,1227],{"id":1226},"structured","Structured",[299,1229,1230,1240],{},[302,1231,1232],{},[305,1233,1234,1236,1238],{},[308,1235,705],{},[308,1237,313],{},[308,1239,710],{},[315,1241,1242,1260],{},[305,1243,1244,1249,1252],{},[320,1245,1246],{},[137,1247,1248],{},"JSON",[320,1250,1251],{},"JSON object or array",[320,1253,1254,369,1257],{},[137,1255,1256],{},"{\"foo\": \"bar\"}",[137,1258,1259],{},"[1, 2, 3]",[305,1261,1262,1266,1271],{},[320,1263,1264],{},[137,1265,258],{},[320,1267,1268,1270],{},[137,1269,262],{}," attribute",[320,1272,1273,369,1276],{},[137,1274,1275],{},"status=200",[137,1277,1278],{},"user_id=42",[154,1280,1282],{"id":1281},"system","System",[299,1284,1285,1295],{},[302,1286,1287],{},[305,1288,1289,1291,1293],{},[308,1290,705],{},[308,1292,313],{},[308,1294,710],{},[315,1296,1297,1318,1338,1356,1374,1392,1407,1425],{},[305,1298,1299,1304,1307],{},[320,1300,1301],{},[137,1302,1303],{},"LOG_LEVEL",[320,1305,1306],{},"Log severity level",[320,1308,1309,369,1312,369,1315],{},[137,1310,1311],{},"INFO",[137,1313,1314],{},"WARN",[137,1316,1317],{},"ERROR",[305,1319,1320,1325,1328],{},[320,1321,1322],{},[137,1323,1324],{},"HTTP_METHOD",[320,1326,1327],{},"HTTP method",[320,1329,1330,369,1332,369,1335],{},[137,1331,809],{},[137,1333,1334],{},"POST",[137,1336,1337],{},"DELETE",[305,1339,1340,1345,1348],{},[320,1341,1342],{},[137,1343,1344],{},"HTTP_VERSION",[320,1346,1347],{},"HTTP protocol version",[320,1349,1350,369,1353],{},[137,1351,1352],{},"HTTP\u002F1.1",[137,1354,1355],{},"HTTP\u002F2.0",[305,1357,1358,1363,1366],{},[320,1359,1360],{},[137,1361,1362],{},"HTTP_STATUS",[320,1364,1365],{},"HTTP status code with reason phrase",[320,1367,1368,369,1371],{},[137,1369,1370],{},"200 OK",[137,1372,1373],{},"404 Not Found",[305,1375,1376,1381,1384],{},[320,1377,1378],{},[137,1379,1380],{},"URI_PATH",[320,1382,1383],{},"File or URL path",[320,1385,1386,369,1389],{},[137,1387,1388],{},"\u002Fapi\u002Fusers",[137,1390,1391],{},"\u002Fvar\u002Flog\u002Fsyslog",[305,1393,1394,1399,1402],{},[320,1395,1396],{},[137,1397,1398],{},"UUID",[320,1400,1401],{},"UUID string",[320,1403,1404],{},[137,1405,1406],{},"88da75f6-a07e-40b3-8c62-f2b28c505ff2",[305,1408,1409,1414,1417],{},[320,1410,1411],{},[137,1412,1413],{},"HASHTAG",[320,1415,1416],{},"Hashtag",[320,1418,1419,369,1422],{},[137,1420,1421],{},"#deploy",[137,1423,1424],{},"#uptrace",[305,1426,1427,1432,1435],{},[320,1428,1429],{},[137,1430,1431],{},"HTML_TAG",[320,1433,1434],{},"HTML tag",[320,1436,1437,369,1440,369,1443],{},[137,1438,1439],{},"\u003Chtml>",[137,1441,1442],{},"\u003C\u002Fdiv>",[137,1444,1445],{},"\u003Cbr\u002F>",[154,1447,1449],{"id":1448},"type-aliases","Type aliases",[123,1451,1452],{},"For compatibility with existing Grok corpora, several types have alternative names:",[299,1454,1455,1465],{},[302,1456,1457],{},[305,1458,1459,1462],{},[308,1460,1461],{},"Alias",[308,1463,1464],{},"Canonical",[315,1466,1467,1478,1489,1500,1511],{},[305,1468,1469,1474],{},[320,1470,1471],{},[137,1472,1473],{},"STRING",[320,1475,1476],{},[137,1477,757],{},[305,1479,1480,1485],{},[320,1481,1482],{},[137,1483,1484],{},"NUM",[320,1486,1487],{},[137,1488,660],{},[305,1490,1491,1496],{},[320,1492,1493],{},[137,1494,1495],{},"INTEGER",[320,1497,1498],{},[137,1499,856],{},[305,1501,1502,1507],{},[320,1503,1504],{},[137,1505,1506],{},"TIMESTAMP_ISO8601",[320,1508,1509],{},[137,1510,1090],{},[305,1512,1513,1518],{},[320,1514,1515],{},[137,1516,1517],{},"SYSLOGTIMESTAMP",[320,1519,1520],{},[137,1521,1134],{},[141,1523,1525],{"id":1524},"fingerprints","Fingerprints",[123,1527,1528,1529,1531,1532,1534],{},"Uptrace groups similar logs and exceptions by hashing certain parts of the message. By default it only hashes literal words; use ",[137,1530,202],{}," (or the ",[137,1533,215],{}," option) to include captured values in the hash.",[123,1536,1537],{},"For example:",[130,1539,1542],{"className":1540,"code":1541,"language":135},[133],"unknown column: %{WORD:#column}\n",[137,1543,1541],{"__ignoreMap":139},[123,1545,1546,1547,542],{},"The pattern above creates a separate group for each column, which is useful for ",[1548,1549,1550],"a",{"href":54},"alerting",[130,1552,1555],{"className":1553,"code":1554,"language":135},[133],"# Group 1\nunknown column: foo\nunknown column: foo\n\n# Group 2\nunknown column: bar\nunknown column: bar\n",[137,1556,1554],{"__ignoreMap":139},[123,1558,1559,1560,1563],{},"You can also set the ",[137,1561,1562],{},"grouping.fingerprint"," attribute when creating logs and exceptions, which overrides the automatically derived fingerprint:",[130,1565,1569],{"className":1566,"code":1567,"language":1568,"meta":139,"style":139},"language-go shiki shiki-themes github-light","span := trace.SpanFromContext(ctx)\n\nspan.AddEvent(\"exception\", trace.WithAttributes(\n    attribute.String(\"exception.type\", \"*exec.ExitError\"),\n    attribute.String(\"exception.message\", \"exit status 1\"),\n    attribute.String(\"grouping.fingerprint\", \"exec.ExitError\"),\n))\n","go",[137,1570,1571,1594,1600,1625,1647,1666,1685],{"__ignoreMap":139},[1572,1573,1576,1580,1584,1587,1591],"span",{"class":1574,"line":1575},"line",1,[1572,1577,1579],{"class":1578},"sgsFI","span ",[1572,1581,1583],{"class":1582},"sD7c4",":=",[1572,1585,1586],{"class":1578}," trace.",[1572,1588,1590],{"class":1589},"s7eDp","SpanFromContext",[1572,1592,1593],{"class":1578},"(ctx)\n",[1572,1595,1597],{"class":1574,"line":1596},2,[1572,1598,1599],{"emptyLinePlaceholder":10},"\n",[1572,1601,1603,1606,1609,1612,1616,1619,1622],{"class":1574,"line":1602},3,[1572,1604,1605],{"class":1578},"span.",[1572,1607,1608],{"class":1589},"AddEvent",[1572,1610,1611],{"class":1578},"(",[1572,1613,1615],{"class":1614},"sYBdl","\"exception\"",[1572,1617,1618],{"class":1578},", trace.",[1572,1620,1621],{"class":1589},"WithAttributes",[1572,1623,1624],{"class":1578},"(\n",[1572,1626,1628,1631,1634,1636,1639,1641,1644],{"class":1574,"line":1627},4,[1572,1629,1630],{"class":1578},"    attribute.",[1572,1632,1633],{"class":1589},"String",[1572,1635,1611],{"class":1578},[1572,1637,1638],{"class":1614},"\"exception.type\"",[1572,1640,369],{"class":1578},[1572,1642,1643],{"class":1614},"\"*exec.ExitError\"",[1572,1645,1646],{"class":1578},"),\n",[1572,1648,1650,1652,1654,1656,1659,1661,1664],{"class":1574,"line":1649},5,[1572,1651,1630],{"class":1578},[1572,1653,1633],{"class":1589},[1572,1655,1611],{"class":1578},[1572,1657,1658],{"class":1614},"\"exception.message\"",[1572,1660,369],{"class":1578},[1572,1662,1663],{"class":1614},"\"exit status 1\"",[1572,1665,1646],{"class":1578},[1572,1667,1669,1671,1673,1675,1678,1680,1683],{"class":1574,"line":1668},6,[1572,1670,1630],{"class":1578},[1572,1672,1633],{"class":1589},[1572,1674,1611],{"class":1578},[1572,1676,1677],{"class":1614},"\"grouping.fingerprint\"",[1572,1679,369],{"class":1578},[1572,1681,1682],{"class":1614},"\"exec.ExitError\"",[1572,1684,1646],{"class":1578},[1572,1686,1688],{"class":1574,"line":1687},7,[1572,1689,1690],{"class":1578},"))\n",[141,1692,1694],{"id":1693},"examples","Examples",[123,1696,1697],{},"Go-style error messages:",[130,1699,1702],{"className":1700,"code":1701,"language":135},[133],"# Messages\nstrconv.ParseInt failed\nSendEmail failed\nmypkg.MyFunc failed\n\n# Pattern\n%{IDENT:#code_function} failed\n",[137,1703,1701],{"__ignoreMap":139},[123,1705,1706],{},"PostgreSQL unknown column errors:",[130,1708,1710],{"className":1709,"code":134,"language":135},[133],[137,1711,134],{"__ignoreMap":139},[123,1713,1714],{},"A single grouping rule may declare multiple patterns — any of them matching is enough:",[130,1716,1719],{"className":1717,"code":1718,"language":135},[133],"can't find item %{NUMBER:item_id}\ncan not find item %{NUMBER:item_id}\n%{NUMBER:item_id} not found\n",[137,1720,1718],{"__ignoreMap":139},[141,1722,1724],{"id":1723},"conclusion","Conclusion",[123,1726,1727,1728,1732,1733,528,1737,490],{},"Grouping rules work best with ",[1548,1729,1731],{"href":1730},"\u002Fglossary\u002Fstructured-logging","structured logs"," and are not a replacement for the log parsers provided by ",[1548,1734,1736],{"href":1735},"\u002Fopentelemetry\u002Flogs","OpenTelemetry Logs",[1548,1738,1740],{"href":1739},"\u002Fingest\u002Flogs\u002Fvector","Vector",[1742,1743,1744],"style",{},"html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":139,"searchDepth":1627,"depth":1596,"links":1746},[1747,1760,1769,1770,1771],{"id":143,"depth":1596,"text":144,"children":1748},[1749,1750,1751,1752,1753,1754,1756,1757,1758],{"id":156,"depth":1602,"text":157},{"id":169,"depth":1602,"text":170},{"id":186,"depth":1602,"text":187},{"id":225,"depth":1602,"text":226},{"id":284,"depth":1602,"text":285},{"id":456,"depth":1602,"text":1755},"Regex extraction (extract option)",{"id":507,"depth":1602,"text":508},{"id":534,"depth":1602,"text":535},{"id":560,"depth":1602,"text":1759},"Repeat matchers (%{ANY}+ \u002F %{ANY}*)",{"id":621,"depth":1596,"text":622,"children":1761},[1762,1763,1764,1765,1766,1767,1768],{"id":135,"depth":1602,"text":696},{"id":815,"depth":1602,"text":816},{"id":926,"depth":1602,"text":927},{"id":1054,"depth":1602,"text":1055},{"id":1226,"depth":1602,"text":1227},{"id":1281,"depth":1602,"text":1282},{"id":1448,"depth":1602,"text":1449},{"id":1524,"depth":1596,"text":1525},{"id":1693,"depth":1596,"text":1694},{"id":1723,"depth":1596,"text":1724},"Create Grok-style log grouping rules that normalize noisy messages and generate consistent fingerprints for recurring issues.","md",null,{"readingTime":1776},{"text":1777,"minutes":1778,"time":1779,"words":1780},"5 min read",4.115,246900,823,{"title":35,"description":1772},"2AitJR7I_MadfUz6WZbVVSkyxGkRgE8ympCFbRPgppU",[1784,1786],{"title":15,"path":30,"stem":31,"description":1785,"children":-1},"Browse grouped logs and errors in Uptrace, filter by service or severity, search by text or attribute, and inspect individual records with aggregated stats and per-entry details.",{"title":15,"path":40,"stem":41,"description":1787,"children":-1},"Monitor infrastructure and application metrics in Uptrace using pre-built dashboards with table and grid views, or explore any metric interactively with aggregations, grouping, and filters.",1778588617815]