topic rename the result of replaceString in DQL

rename the result of replaceString

GerryIsHere — Tue, 27 Feb 2024 18:21:18 GMT

I have this query

fetch logs
| filter matchesValue(host.name, "dar*")
and matchesPhrase(log.source, "mydomain")
and matchesPhrase(log.source, "diagnostic")
and matchesValue(status, "ERROR")
| fieldsAdd replaceString(content, "\n", " ")
| parse replaceString(content, "\n", " "), "LD 'Message=\"' LD:message'\"' LD 'TransactionId' LD"
| fieldsKeep message

See the parse replaceString(content, "\n", " ") part, isn't that bizarre?

The documentation doesn't tell me how to rename the result of replaceString and creates that weird field name. How can I give it a meaningful name to use in the parse?

thanks!

Re: rename the result of replaceString

Miguel_RinconG — Tue, 27 Feb 2024 19:58:39 GMT

Hi @GerryIsHere

It's a lines breaks. I recommend use replacePattern and DPL.

Re: rename the result of replaceString

GerryIsHere — Tue, 27 Feb 2024 20:10:48 GMT

I need the part at the end, not the part at the beginning. Are you saying use something like LD EOL LD EOL LD:lastline?

Re: rename the result of replaceString

Miguel_RinconG — Wed, 28 Feb 2024 13:46:15 GMT

Hi,

For example the EOS use:

data record(content="_ga_22HX2S1N7P=GS1.1.1702351529.1.0.1702351529.0.0.0\" 3806 1945 ") | parse content, "LD STRUCTURE{DOUBLE:bytes.re ' ' DOUBLE:bytes.send SPACE}?:struct EOS" | fieldsAdd struct[bytes.re] | fieldsAdd struct[bytes.send]

Re: rename the result of replaceString

GerryIsHere — Wed, 28 Feb 2024 19:32:46 GMT

The solution is to use DATA and not LD, and forget about replaceString