topic Re: Fetch logs from all hosts with a Tag in DQL

Fetch logs from all hosts with a Tag

S_Hadley1138 — Wed, 20 Dec 2023 08:27:56 GMT

Hi there,

I'm a newbie, so please don't flame me. I'm trying to get the logs from all hosts that have a certain Tag... i can get the hosts, but them how do i feed that to a fetch logs ?

fetch dt.entity.host | filter matchesValue(tags,"MESSAGING:DAG01")
| fetch logs

doesn't seem to work

any pointers would be appreciated, cheers

Re: Fetch logs from all hosts with a Tag

gbaudart — Tue, 19 Dec 2023 19:51:25 GMT

Hi @S_Hadley1138,

Try this :

fetch logs | lookup [ fetch dt.entity.host | filter matchesValue(tags,"MESSAGING:DAG01") ],lookupField:id, fields:{id}

Let me know if it's ok for you

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Wed, 20 Dec 2023 09:59:32 GMT

thanks for responding. it does execute, but its not respecting the tag, and pulling everything back. it seems i can put anything in the tag field in the query and get the same results... very odd

ive tried to show in the screenshot, that the hosts its pulling back are citrix, rather than messaging, and have different tags

Re: Fetch logs from all hosts with a Tag

gbaudart — Wed, 20 Dec 2023 12:41:44 GMT

Ooh.. so you can try this :

fetch logs | lookup [ fetch dt.entity.host ],sourceField:dt.entity.host, lookupField:id, fields:{id,tags} | filter matchesValue(tags,"MESSAGING:DAG01")

Re: Fetch logs from all hosts with a Tag

gbaudart — Wed, 20 Dec 2023 12:55:19 GMT

@S_Hadley1138
oooh.. So you can try this one :

fetch logs | lookup [ fetch dt.entity.host ],sourceField:dt.entity.host, lookupField:id, fields:{id,tags} | filter matchesValue(tags,"MESSAGING:DAG01")

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Wed, 20 Dec 2023 13:39:26 GMT

close, but that doesn't return anything...

i can see what you are doing with the filter, as this query returns the host names ok

fetch dt.entity.host
|fieldsAdd entity.name
| filter matchesValue(tags,"MESSAGING:DAG01")

just need to get the logs to filter by this list.... so close

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Wed, 20 Dec 2023 15:11:26 GMT

sadly, that return no results. the filter part works against the hosts table, it just doesnt want to connect the two parts. any other ideas?

Re: Fetch logs from all hosts with a Tag

gbaudart — Wed, 20 Dec 2023 16:16:39 GMT

It's curious because I tested the command on my environment and it works well..

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Wed, 20 Dec 2023 16:42:58 GMT

i agree, as i think it is along the right lines..... I've included a screenshot, i can prove the tags are right... i must be doing something wrong

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Wed, 20 Dec 2023 17:00:59 GMT

count it be because there are many Tags? might it need to be a 'containsValue' rather than matchesValue? or whatever the DQL equivalent is? in your testing, try it with several tags....

Re: Fetch logs from all hosts with a Tag

gbaudart — Wed, 20 Dec 2023 19:36:53 GMT

can you observe the desired tags with the following command?

fetch dt.entity.host | filter matchesValue(tags,"MESSAGING:DAG01") | fields entity.name, id, tags

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Thu, 21 Dec 2023 13:43:52 GMT

yep, that query works fine (apologies for the red, im trying to obscure the company name)

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Thu, 21 Dec 2023 14:47:15 GMT

i may have found the issue.... seems our servers were not enabled for collecting the windows application logs, so there are no logs to find... apologies for that

Re: Fetch logs from all hosts with a Tag

gbaudart — Thu, 21 Dec 2023 20:31:10 GMT

That might explain it all ^^

Re: Fetch logs from all hosts with a Tag

S_Hadley1138 — Fri, 22 Dec 2023 08:57:40 GMT

like I said, I am a Newbie... (and a Muppet...) thanks for your help