topic Parse Json logs with a compact json formatter in DQL

Parse Json logs with a compact json formatter

faraz — Wed, 11 Sep 2024 12:43:21 GMT

Hi,
I am trying to come up with a query to parse the incoming log with compact json format from Serilog

The problem I am facing is I cant use @ for the matcher name.

Sample log

{"@t":"2024-09-11T05:25:43.6670035Z","@mt":"Finished publishing product updates.","@tr":"84074a2818729843acdaa18a3650fed5"}

Query

fetch logs
| filter matchesPhrases (content,"12025657") // to get the exact logs
| parse content, "JSON:structuredLog"
| fieldsadd client_time = structuredLog[@t] // <--- Syntax Error here with the @t

Any advice would be appreciated

Thanks

Re: Parse Json logs with a compact json formatter

PedroSantos — Wed, 11 Sep 2024 15:26:03 GMT

Hi @faraz,

You can try using back ticks as detailed here:

Re: Parse Json logs with a compact json formatter

faraz — Wed, 11 Sep 2024 23:29:43 GMT

Works like a charm.

Thanks @PedroSantos