topic Re: DPL (Classic Logs Processing) with "Unrecognized character escape" in Log Analytics

DPL (Classic Logs Processing) with "Unrecognized character escape"

AntonioSousa — Wed, 13 Aug 2025 23:50:47 GMT

In Classic Log processing, I'm trying to process content that has what seem to be nonexistent escape characters:

I'm trying to extract "asousa" but with no success. I can get partial results, but I can't even "Save changes"...

Any ideas?

Re: DPL (Classic Logs Processing) with "Unrecognized character escape"

Akhil-Jayendran — Thu, 14 Aug 2025 02:56:25 GMT

Hi @AntonioSousa ,

A back slash will not help here ?

Re: DPL (Classic Logs Processing) with "Unrecognized character escape"

AntonioSousa — Thu, 14 Aug 2025 08:34:11 GMT

@Akhil-Jayendran

Thanks for the suggestion, but in my case, in content, there's only one '\' ...

Re: DPL (Classic Logs Processing) with "Unrecognized character escape"

Akhil-Jayendran — Thu, 14 Aug 2025 13:20:17 GMT

Hi @AntonioSousa ,

The log sample in the processing rule config is a JSON file. The additional backslash is to tell JSON, “I really mean a backslash here.”You escape the backslash itself.

Here is my sample logs

Re: DPL (Classic Logs Processing) with "Unrecognized character escape"

AntonioSousa — Thu, 14 Aug 2025 14:37:30 GMT

@Akhil-Jayendran ,

In JSON you really have to escape a '\', but in a normal "content" log field, you upload strings, and they are not escaped...

Re: DPL (Classic Logs Processing) with "Unrecognized character escape"

Akhil-Jayendran — Thu, 14 Aug 2025 15:47:37 GMT

Hello @AntonioSousa ,

That’s correct, normal log content will always be a string. What I’m trying to say is that, in the log processing rule, we can only provide JSON as sample logs. To make the rule work, we need to use escapes in the logs; otherwise, the rule won’t be accepted.

Re: DPL (Classic Logs Processing) with "Unrecognized character escape"

Yosi_Neuman — Sat, 16 Aug 2025 08:42:33 GMT

Hi @AntonioSousa

You can change the log sample and add another \

Before:

After

Not sure if after saving this parse will work 🤔... but at least is saved 😉

HTH

Yos