Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON

pallepavan — Wed, 18 Oct 2023 17:07:43 GMT

is it possible to add a field to logs by check if a KEY exist in a Parsed JSON while processing logs,

JSON SAMPLE :
{

"name" : "test"

"action" : "some random string"

...

}

requirement : add a new_feild as log attribute if json contains a key named "action"

PARSE(content,"JSON:data") |
FIELDS_ADD( new_feild: IF{ ???? })

Re: Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON

dannemca — Fri, 27 Oct 2023 21:06:11 GMT

Hi @pallepavan

Yep, you can do that. You don't even need to parse your json, assuming the string 'action' is not present anywhere.

|fieldsAdd hasaction = contains(content,"action")

This will add a 'hasaction' field as boolean (true/false) to your results. Then you can use it in your IF condition, to add a new field with some other log attribute.

Check this doc to get more details: https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/functions#if

topic Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON in DQL

Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON

Re: Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON