DQL+ DPL summarize

y_buccellato — Mon, 22 Jul 2024 11:53:00 GMT

Good afternoon community,

I'm trying to summarize the count of some exception - everything it's easy but some exception may vary based on some ID contained in the text. For example:

Inbound processing in endpoint at /IOM/**** failed with message "Fault:Sequential processing failed for number 0. Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"

Is there a way with a combination of DQL and DPL, or just one of the two to say "If field containing exception with: [ID-**] then keep the everything as it is but just transform [ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098] into [ID-*]" ?

Regards

Re: DQL+ DPL summarize

krzysztof_hoja — Mon, 22 Jul 2024 17:37:07 GMT

Yes, it is possible with combination of couple of functions. I used example line and created 5 log lines out it with different IDs (2+2+1)

data record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""), record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""), record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-99cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""), record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-88cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""), record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-88cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded""") | fieldsAdd content = if( matchesPhrase(content, "Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]"), content, else: replacePattern(content, "'Exchange[ID' LD ']'", "Exchange[ID-*]" ) ) | summarize {cnt=count()}, by: {content}

If line contains given ID, I leave it without modifications. In other cases I use replacePattern function to modify content and remove not needed ID. After this operation when I summarize by content I just get 2 groups

I hope I understood the need correctly

Kris

Re: DQL+ DPL summarize

y_buccellato — Tue, 23 Jul 2024 15:10:59 GMT

I adapted it based on your clear explanation given your understanding and it works perfectly.

Thank you

topic Re: DQL+ DPL summarize in DQL

DQL+ DPL summarize

Re: DQL+ DPL summarize

Re: DQL+ DPL summarize