Bad Request: Not supported

[gauravpareekk]

Hi!

Dashboard fails with following issue
my grafana agent yml

server:
  http_tls_config:
    cert_file: /etc/grafana/grafana.crt
    key_file: /etc/grafana/grafana.key

metrics:
  wal_directory: /tmp/wal
  global: {}
  configs:
    - name: default
      remote_write:
        - url: http://localhost:3100/api/prom/push
          basic_auth:
            username: qryn
            password: xxx
logs:
  positions_directory: /tmp/loki-pos
  configs:
    - name: default
      scrape_configs: []
      clients:
        - url: http://qryn:xxx@localhost:3100/loki/api/v1/push
traces:
  configs:
    - name: default
      remote_write:
        - endpoint: localhost:3100
          insecure: true
          basic_auth:
            username: qryn
            password: xxx
      receivers:
        otlp:
          protocols:
            grpc:
            http:
              cors:
                allowed_origins:
                  - http://*
                max_age: 7200

integrations:
  app_agent_receiver_configs:
    - autoscrape:
        enable: true
        metrics_instance: 'default'
      # api_key: 'secret' # optional, if set, client will be required to provide it via x-api-key header
      instance: 'frontend'
      logs_instance: 'default'
      traces_instance: 'default'
      server:
        host: 0.0.0.0
        port: 12345
        cors_allowed_origins:
          - http://*
          #        cors_allowed_origins:
          #          - 'https://my-app.example.com'
      logs_labels: # labels to add to loki log record
        app: frontend # static value
        kind: # value will be taken from log items. exception, log, measurement, etc
      logs_send_timeout: 5000
      sourcemaps:
        download: true

qryn is running

version: '3.8'

services:
  qryn:
    image: qxip/qryn:3.1.2
    ports:
      - "3100:3100"
    environment:
      - CLICKHOUSE_SERVER=clickhouse-server
      - CLICKHOUSE_AUTH=qryn:supersecretpassword
      - CLICKHOUSE_DB=qryn
  clickhouse-server:
    image: clickhouse/clickhouse-server:latest
    container_name: clickhouse-server
    environment:
      - CLICKHOUSE_USER=qryn
      - CLICKHOUSE_PASSWORD=xxx
    ports:
      - 8123:8123
    healthcheck:
      test: ['CMD', 'wget', '--spider', '-q', '127.0.0.1:8123/ping']
      interval: 1s
      timeout: 1s
      retries: 30

dashboard is failing with error:
qryn-qryn-1 | {"level":50,"time":1706524505440,"pid":20,"hostname":"ab7c2cb2986a","name":"qryn","reqId":"req-2k","err":"Not supported\nBad Request: Not supported\n at topBottom (/app/parser/registry/parameterized_aggregation_registry/index.js:14:11)\n at Object.topk (/app/parser/registry/parameterized_aggregation_registry/index.js:50:12)\n at module.exports.transpile (/app/parser/transpiler.js:228:49)\n at instantQueryScan (/app/lib/db/clickhouse.js:255:29)\n at Object.handler (/app/lib/handlers/query.js:30:28)\n at routeOptions.handler (/app/node_modules/@fastify/websocket/index.js:150:24)\n at preHandlerCallback (/app/node_modules/fastify/lib/handleRequest.js:137:37)\n at validationCompleted (/app/node_modules/fastify/lib/handleRequest.js:121:5)\n at preValidationCallback (/app/node_modules/fastify/lib/handleRequest.js:98:5)\n at handler (/app/node_modules/fastify/lib/handleRequest.js:75:7)","msg":"Not supported"}

[akvlad]

Hello. Do you request something like topK(5, rate({a="b"} | json [10m])) ?

[gauravpareekk]

I don't think so. This is the error we're seeing from Grafana dashboard end.

[akvlad]

Well Not supported\nBad Request: Not supported in this case means that topK with | json or | logfmt is not supported.
Please try using | json a="obj.a" - json with parameters with topK.
I'll recheck the grafana agent but it seems like a human built request with | json and topk from grafana explore or a dashboard.

[gauravpareekk]

ok do we have a rebuilt dashboard that can be used?

[gauravpareekk]

I'm using the prebuilt dashboard and just imported that to grafana

[akvlad]

can you please share a link to the prebuilt dashboard you use? is it from an open source?

[akvlad]

another question. "reqId":"req-2k"
can you please filter the logs by req-2k string and paste the request causing the error?

[akvlad]

do you have a widget named Top Exceptions inside the prebuilt dashboard?

[gauravpareekk]

Yes

[akvlad]

I think I see the source of the prebuilt dashboard you have.
https://github.com/grafana/faro-web-sdk/blob/main/dashboards/frontend-application.json#L995
As you see at this line https://github.com/grafana/faro-web-sdk/blob/main/dashboards/frontend-application.json#L990C11-L990C23

topk(10, count(count_over_time({kind="exception", app="$app"} | logfmt [$__range])) by (value))

The request is not supported for now. We should either replace it or support it.
I'll think about that. Maybe it's easier to make a quick replacement.

[gauravpareekk]

sure, thanks. At this moment, we can't do anything about it?

[akvlad]

We will suggest the requests replacements shortly.

[akvlad]

Suggested replacements for some of widgets of the dashboard:

Top Exceptions
topk(10, count(count_over_time({kind="exception", app="$app"} | regexp "value=(?<value>([^\"]+|\"[^\"]+\"))" [$__range])) by (value))

Top URLs by Exception Count
topk(10, count(count_over_time({kind="exception", app="$app"} | regexp "page_url=(?<page_url>([^\"]+|\"[^\"]+\"))" [$__range])) by (page_url))

Top Browsers by Exception Count
topk(10, count(count_over_time({kind="exception", app="$app"} | regexp "browser_name=(?<browser_name>([^\"]+|\"[^\"]+\")).*browser_version=(?<browser_version>([^\"]+|\"[^\"]+\"))" [$__range])) by (browser_name, browser_version))

Popular Browsers
topk(10, count(count_over_time({app="$app",kind="measurement"} |= " ttfb=" | regexp "browser_name=(?<browser_name>([^\"]+|\"[^\"]+\")).*browser_version=(?<browser_version>([^\"]+|\"[^\"]+\"))" [$__range])) by (browser_name, browser_version))

Top Events
topk(10, count(count_over_time({kind="event", app="$app"} | regexp "event_name=(?<event_name>([^\"]+|\"[^\"]+\"))" [$__range])) by (event_name))

The Not supported error should not appear after the changes are made.

It's an interesting logic to replace logfmt to regexp if possible. Sounds like a feature request. Thanks for the issue.

[gauravpareekk]

thank you for helping here. We were able to pull the data. However, these ones are still throwing error

Cumulative Layout Shift, p75
quantile_over_time(0.75, {kind="measurement",app="$app"} |= " cls=" | logfmt | unwrap cls [5m]) by (app)

First Input Delay, p75
quantile_over_time(0.75, {kind="measurement",app="$app"} |= " fid=" | logfmt | unwrap fid [5m]) by (app)

Page Load, p75
quantile_over_time(0.75, {kind="measurement",app="$app"} |= " ttfb=" | logfmt | unwrap ttfb [5m]) by (app)

quantile_over_time(0.75, {kind="measurement",app="$app"} |= " fcp=" | logfmt | unwrap fcp [5m]) by (app)

quantile_over_time(0.75, {kind="measurement",app="$app"} |= " lcp=" | logfmt | unwrap lcp [5m]) by (app)

[akvlad]

I see. Will provide the same replacement.
Feel free to do it yourself. Just replace | logfmt with | regexp "lcp=(?<lcp>([^\"]+|\"[^\"]+\"))"

[gauravpareekk]

thank you that worked