Use the negation operator in DPL

educampver — Thu, 01 Jun 2023 11:23:27 GMT

Hi,

How can we use the negation operator in DPL? For instance, in the example below, the DataKey is always a string of 24 digits. It is essentially a timestamp followed by an identifier. I need to check log records when this DataKey is malformed or has a length of less than 24 characters. Example log record:

<TaskQueue ... DataKey="202303281310073066696996">
  ...
</TaskQueue>

Thanks in advance.

Re: Use the negation operator in DPL

sinisa_zubic — Thu, 01 Jun 2023 11:24:20 GMT

Hi there,

please have a look at following query

data record(content="""<TaskQueue DataKey="202303281310073066696997"></TaskQueue>""") | parse content, "DATA 'DataKey=' DQS:datakey" | parse datakey, "TIMESTAMP('YYYYMMddHHmmssSSSSS'):date" | parse datakey, "[0-9]{24}:numandlength" | fieldsAdd malformed = if(isNull(datakey),true,else:false) | fieldsAdd malformed = if(isNull(date),true,else:malformed) | fieldsAdd malformed = if(isNull(numandlength),true,else:malformed ) | fieldsAdd malformed = if(Stringlength(datakey)!=24,true,else:malformed)

some explanation

fist lets parse and extract the DataKey from the content. It is within a double-quoted string (therefore the DQS matcher)
then let's parse the and extract DataKey to date and as well to a 24 digits long number
afterward you check if any of those fields isNull. If yes, you set malformed to true

Best,
Sini

topic Use the negation operator in DPL in DQL

Use the negation operator in DPL

Re: Use the negation operator in DPL