topic Re: Why is wildcard required in DQL matchesPhrase with host.name? in DQL

Why is wildcard required in DQL matchesPhrase with host.name?

GerryIsHere — Thu, 15 Feb 2024 19:34:13 GMT

This fails:

fetch logs
| filter matchesPhrase(host.name, "carn") // fail
and matchesPhrase(log.source, "rmwfeapi")
and matchesPhrase(content, "Unable")
| fieldsKeep timestamp, host.name, content, log.source

This works:

fetch logs
| filter matchesPhrase(host.name, "carn*") // why is wildcard required?
and matchesPhrase(log.source, "rmwfeapi")
and matchesPhrase(content, "Unable") // this works!
| fieldsKeep timestamp, host.name, content, log.source

What is it about host.name that matchesPhrase doesn't work as expected? It can find "Unable" in the middle of content but it can't find "carn" at the beginning of host.name? Why not?

Re: Why is wildcard required in DQL matchesPhrase with host.name?

dannemca — Thu, 15 Feb 2024 19:40:17 GMT

MatchPhrase should match the exact value you are querying.

So I am assuming your host name is not only carn, but carn'something'.

Can you confirm?

If you want to filter by hostname with just a piece of the name without using the wildcard, you can use the contains instead.

Re: Why is wildcard required in DQL matchesPhrase with host.name?

GerryIsHere — Thu, 15 Feb 2024 19:52:23 GMT

My message says "carn*" works and "carn" does not. If "carn" was the server name "carn" would work. I think this is a DQL bug.

Re: Why is wildcard required in DQL matchesPhrase with host.name?

dannemca — Thu, 15 Feb 2024 19:55:43 GMT

That's not a bug, that's just how matchPhrase works:

https://docs.dynatrace.com/docs/observe-and-explore/logs/lma-log-processing-matcher#lp-dql-matchesPhrase

It should match the phrase you are looking for. If you want to get a string piece only, you should use "contains" instead.

https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/functions/string-functions#contains

Re: Why is wildcard required in DQL matchesPhrase with host.name?

GerryIsHere — Thu, 15 Feb 2024 20:13:12 GMT

Please let someone from Dynatrace respond thanks.

Re: Why is wildcard required in DQL matchesPhrase with host.name?

GerryIsHere — Thu, 15 Feb 2024 22:01:21 GMT

because word boundaries count