topic Exclude word in log injection rules in Log Analytics

Exclude word in log injection rules

alex94 — Tue, 23 Jan 2024 15:04:16 GMT

Hello,

is there a way to exclude word when making a log ingest rules for a host?

For example, I want to include in Storage logs that match "/health/ready" but doens't have "StatusCode: 200".

How can i write a not matching expression?

Thank you

Re: exclude word in log injection rules

Pawel_Zalewski — Sat, 20 Jan 2024 15:22:55 GMT

Hi,

There are only 2 options:

If no wildcard is used in the value, then the matcher looks for an exact fit to the value.
If a wildcard is used, the matcher looks for the exact match.

For example, the value INFO results in sending only the log data having the exact INFO string, but the value *INFO* (using the wildcards) matches log data that contain the INFO string in its content.

Re: exclude word in log injection rules

PacoPorro — Mon, 22 Jan 2024 07:22:48 GMT

Can I suggest to use 2 rules?
1st rule should exclude StatusCode: 200
2nd rule should include /health/ready

Re: exclude word in log injection rules

alex94 — Mon, 22 Jan 2024 13:12:55 GMT

Thank you for the info!

We are new to Dynatrace and I am currently looking at the different possibilities of ingest rules to make sure we don't keep useless logs because we have a lot of them.

I wanted to know if that was possible to do it with one rules, but i can for sure do it with multiple rules using include and exclude.

Re: exclude word in log injection rules

PacoPorro — Mon, 22 Jan 2024 13:15:23 GMT

As far as I know, it is not possible to use a single rule.
Note that rules are evaluated from top to bottom, which means that exclusion must come before inclusion.