topic log processing- custom rule in Log Analytics

log processing- custom rule

idand — Thu, 09 Mar 2023 08:02:43 GMT

Hi Team,

In the log monitoring section I need to create a new rule that will

collect a specific word, for example the name of the attribute is "requesturl ":

and the outcome contains \*\*\rest\*\ but the convention is not necessarily at the same order , that means that the location for the "rest" can be changed .

The question is if It possible to create a new rule that will display only a specific word and then to present it at the side bar .

Thanks in advance

Re: log processing- custom rule

MaciejNeumann — Fri, 12 May 2023 12:15:16 GMT

Hello @idand ,

Could you provide us with more information about your issue? Are you using Log Monitoring Classic or Log Management and Analytics powered by Grail?

Re: log processing- custom rule

idand — Sun, 14 May 2023 05:40:20 GMT

Hi MaciejNeumann ,

We are using Log Monitoring Classic .

Thanks !

Re: log processing- custom rule

MaciejNeumann — Mon, 15 May 2023 09:51:24 GMT

Just got the answer from our developers 🙂

Yes, it is possible, for example:FILEDS_ADD(requesturl,"static_word")will add attribute called requesturl with value "static_word".
In LM Classic to present such attribute in side bar you need to define it in custom attributes settings with enabled option "Show attribute values in side bar"

Re: log processing- custom rule

sundarv1 — Thu, 18 Apr 2024 14:19:52 GMT

og.source= "/opt/jboss/var/main.log" AND (content="error" OR content="ERROR" OR content="warning" OR content="Warning") - this is our log source. we want to get alert only if first line of content starts with error.

With the above setting, it is generating alerts when there is word "ERROR" in the entire log file

Re: log processing- custom rule

sundarv1 — Thu, 18 Apr 2024 14:56:17 GMT

How to generate alerts from the log file only if first line in the log file has "ORA".