Log Processing "CASE" ?

AntonioSousa — Mon, 08 Apr 2024 19:44:02 GMT

When processing a log I have, I need to give an attribute a value based on a single character in the log entries. Basically, I need to do the following translations:

'N' -> North
'S' -> South
'E' -> East
'W' -> West

What would be the best and efficient way to do it?

Re: Log Processing "CASE" ?

sattilas — Sat, 20 Apr 2024 19:57:39 GMT

Hi,

I assume it's Log monitoring classic.

The content of the log for example: "2024.04.20 quarter: N"

First, define "my.quarter" attr. :

USING(INOUT, my.quarter:STRING, content)

Then Parse my.quarter from content:

| PARSE(content,"LD 'quarter:' SPACE? STRING:my.quarter")

Then put transformed value to my.renamed_quarter if Letter matches:

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'N', 'NORTH',))

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'S', 'SOUTH',))

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'E', 'EAST',))

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'W', 'WEST',))

The result looks like this:

{
"content": "2024.04.20 quarter: N"
"timestamp": "1656011338522",
"my.quarter": "N",

"my.renamed_quarter": "NORTH"
}

I used this example:

https://docs.dynatrace.com/docs/shortlink/log-monitoring-log-processing-examples#lpexample8

Best,

Attila

topic Log Processing "CASE" ? in Open Q&A

Log Processing "CASE" ?

Re: Log Processing "CASE" ?