This blog post has been edited with ChatGPT March 14 version. Apologies for my laziness.
If you’re working with Humio logs and need to extract specific information from them, you’re not alone. Parsing logs can be a challenging task, but with the right query, you can easily filter and extract the data you need. In this blog post, we’ll show you how to parse a Humio log and find the top 10 error codes using a simple query.

Let’s start by looking at an example Humio log, with a message
field like this:
Webhook from App: {"id":"12345678-1234-1234-1234-123456789012","errorCode":"ERROR_CODE_123","timestamp":"2023-03-25T15:25:02.685193369Z","$type":"ErrorEvent"}
In this log, we have an “ErrorEvent” that contains an “id”, “errorCode”, “timestamp”, and a “$type” field. We want to extract the “errorCode” field and find the top 10 error codes. Now the problem often is that you have the JSON in a simple string, and parsing it can get a big messy.
To do this, we can use the following query:
source=your_app_logs | regex("Webhook from App: (?<incomingWebhookJSON>\\S+)",field=message) | parseJson(field=incomingWebhookJSON) | top(errorCode)
Let’s break down this query step by step:
source=your_app_logs
: This filters the logs to only show those from the app_logs source. You can replace this with the source of your logs. Make sure that your Humio dash only shows message lines which you plan to work on.regex("Webhook from App: (?\incomingWebhookJSON>\\S+)",field=message)
: This parses the JSON substring of yourmessage
string, and copies it to a new field called:incomingWebhookJSON
.parseJson(field=incomingWebhookJSON)
: The calculated field from previous step is now turned into key value pairs, available for subsequent operations.top(errorCode)
: This groups the logs by the “errorCode” field, and lists the top values of the errorCode.
Profit
And that’s it! With this query, we can easily find the top 10 error codes in our logs. You can customize this query to match the structure of your logs and the field you want to extract.
In conclusion, parsing Humio logs doesn’t have to be difficult. With the right query, you can easily filter and extract the data you need. We hope this blog post has been helpful in showing you how to find the top 10 error codes in your logs.
You must be logged in to post a comment.