topic Re: Which DPL syntax is applicable? in DQL

Which DPL syntax is applicable?

WellPP — Wed, 13 Dec 2023 20:55:48 GMT

I am creating a processing rule through MATCHER:

matchesPhrase(content, "setFinalReturnCustomerState") AND dt.entity.cloud_application == "CLOUD_APPLICATION-"

I get the log line that has the content:

{
"@timestamp": "2023-12-13T20:06:07.833+00:00",
"level": "INFO",
"severity": "INFO",
"service": "customer",
"message": "setFinalReturnCustomerState - Customer 11111111111 is Active Open Sea",
"stack_trace": ""
}

I need the information that comes after "is", which could be: Quarantine, Open Sea, No Open Sea.

With this I will create a processing rule for this to become a dimension in my metric. I tried to use DPL Arquiteto but I was not successful in the syntax.

Re: Which DPL syntax is applicable?

gbaudart — Wed, 27 Dec 2023 17:40:49 GMT

Hi @WellPP ,

You can try to add :

| parse content, "LD 'is' STRING:VARIABLENAME" | fields VARIABLENAME

Let me know it's work 🙂

Re: Which DPL syntax is applicable?

gilgi — Mon, 01 Jan 2024 07:33:45 GMT

Actually I would have even do one more step and parsing the content into a JSON object so that you're sure you're parsing only the message itself. something like:

| parse content, "JSON:parsedJsonObj" | parse parsedJsonObj[message], "LD 'is' STRING:customerName" | fieldsRemove parsedJsonObj