Parse multiple entries in quotes

S_Hadley1138 — Thu, 25 Jan 2024 15:48:53 GMT

Just a follow up on this one... but slightly different question, @sinisa_zubic as you are clearly a wizard in this area......

Solved: simple csv event log parse - Dynatrace Community

So IF i have some lines in my log with multiple entries, but not all... for example

2024-01-11T13:23:02.578Z,192.168.0.100,Server1,Tree,Green,Warning
2024-01-11T13:24:06.345Z,192.168.0.103,Server2,Bush,DarkGreen,Alert
2024-01-11T13:27:04.543Z,192.168.0.103,Server2,Road,"Grey,Yellow,White",Alert
2024-01-11T13:28:03.345Z,192.168.0.178,Server5,Path,Black,Bannana

how would I get the this to parse, as the 3rd line has multiple entries in the 5th field, comma separated, but encapsulated in "". the way you showed me wont work as the Colour field is also csv, but in quotes?

JSONTIMESTAMP*:timestamp_parsed ','

IPV4ADDR*:clientip ','

LD*:clienthostname ','

LD*:object ','

(Array{LD*:i ('"' | >>',')}{1,}:Colour)? '",'

LD*:status

any guidance would be appreciated

Re: Parse multiple entries in quotes

krzysztof_hoja — Thu, 25 Jan 2024 19:29:51 GMT

I would do it in 2 steps:
- as 5th field can be just string or quoted string, alterative comes in handy like in previous exercise. There are ready to use DPL matchers for quoted strings: https://docs.dynatrace.com/docs/platform/grail/dynatrace-pattern-language/log-processing-lines-strings#quoted-strings like DQS I used. Please not that order matters.
- when we have color or multiple colors captured in color field, it can be split into array using splitString function

data record(c="2024-01-11T13:23:02.578Z,192.168.0.100,Server1,Tree,Green,Warning"), record(c="2024-01-11T13:24:06.345Z,192.168.0.103,Server2,Bush,DarkGreen,Alert"), record(c="2024-01-11T13:27:04.543Z,192.168.0.103,Server2,Road,\"Grey,Yellow,White\",Alert"), record(c="2024-01-11T13:28:03.345Z,192.168.0.178,Server5,Path,Black,Bannana"), record(c="2024-01-11T13:28:03.345Z,192.168.0.178,Server5,Path,,Nothing") | parse c, "JSONTIMESTAMP*:timestamp_parsed ',' IPV4ADDR*:clientip ',' LD*:clienthostname ',' LD*:object ',' (DQS*:color|LD*:color) ',' LD*:status" | fieldsAdd color=splitString(color,",")

Result looks like this:

topic Parse multiple entries in quotes in DQL

Parse multiple entries in quotes

Re: Parse multiple entries in quotes