Failures on processing logs

isi-consultor-m — Mon, 02 Jun 2025 21:14:24 GMT

Hi Everyone,

I'm trying to extract a field to convert it into a metric using processing logs.

My log sample is:

{
"event.type": "LOG",
"content": "2025-06-02 15:17:19.015 -05:00 RegistrarProcesoTDAsync solicitado. Parámetros: {\"NumeroTarjeta\":\"4863550000xxxxxx\",\"FechaExpiracion\":\"xxxx\",\"TipoTransaccion\":\"00\",\"PaisTransaccion\":333,\"TipoComercio\":\"0000\",\"ValorDebito\":55.55,\"Descripcion\":\"SUPER CENTRO PA\",\"CompraParcial\":\"N\",\"IdTransaccion\":\"20250FFF-03-461YYY-3634ZZZ-51532000UUUU\",\"TraceID\":\"557XXXX\",\"CodigoCanal\":13}"
}

On processor definition a put the following:
PARSE(content, "LD JSON{INT:CodigoCanal}(flat=true)")
| FIELDS_RENAME(Canal:CodigoCanal)

Then when run test the rule, an error message appears: "The matcher query doesn't match the provided log sample."

Can you help me by telling me what i'm missing?

Thanks in advance

Re: Failures on processing logs

GerardJ — Tue, 03 Jun 2025 08:25:48 GMT

Hi @isi-consultor-m
This error message means that your log sample doesn't match the matching condition.
Example of a matching condition in a pipeline :

topic Failures on processing logs in DQL

Failures on processing logs

Re: Failures on processing logs