topic Re: DQL fields contains list of values in DQL

DQL fields contains list of values

Nicolas_S — Wed, 12 Mar 2025 13:54:21 GMT

Hello,

From my logs, i need to add a tag "warning" if the reqPath field contains one of ID like "UID1" "UID2" "UID3" "UID4".
Davis Copilot Answer to this question is :

fetch logs | fieldsAdd warning = if(contains(reqPath, "UID1") OR contains(reqPath, "UID2") OR contains(reqPath, "UID3") OR contains(reqPath, "UID4"), "warning", else:NULL)

It works but it's not possible to maintain with a list of hundreds of UID.

Is there a way in DQL to search a list of terms in a specific field?

Thanks and regards,

Re: DQL fields contains list of values

JeanBlanc — Mon, 14 Apr 2025 12:30:40 GMT

Hi @Nicolas_S

Yes, instead of listing each UID with contains(), you can use matchesValue() with wildcards if all your UIDs follow a common pattern.

For example:

fetch logs | fieldsAdd warning = if(matchesValue(reqPath, "*UID*"), "warning", else:NULL)

This will add the "warning" tag to any log where the reqPath contains something like "UID".

It’s much simpler and easier to maintain when you have many UIDs with a similar format.

Best regards!

Re: DQL fields contains list of values

krzysztof_hoja — Fri, 18 Apr 2025 20:37:57 GMT

More condensed version of such expressions (together with application example) looks like this:

data record(reqPath="aaaa UID1 bbbb"), record(reqPath="aaaa UID2 bbbb"), record(reqPath="aaaa UID3 bbbb"), record(reqPath="aaaa UID4 bbbb"), record(reqPath="aaaa UID5 bbbb") | fieldsAdd warning=if(iAny(contains(reqPath, array("UID1","UID3","UID5")[])),"warning")

result:

Re: DQL fields contains list of values

marco_irmer — Fri, 18 Apr 2025 21:56:18 GMT

I would recommend using the matchesPattern function for this scenario. This function allows you to test whether the field matches a specific DPL pattern.

Re: DQL fields contains list of values

Nicolas_S — Wed, 23 Apr 2025 07:43:12 GMT

Hello,

Thank you that's exactly what i was looking for.

The fields values are not UID1 UID2 and so on but real UID like 587a4b2c-9d3e-1f0g, a1b2-c3d4-e5f6-7890, etc which are very difficult to use with DPL or wildcards solutions.