topic Log (classic) ingest rule , host tag matcher attribute in Log Analytics

Log (classic) ingest rule , host tag matcher attribute

Yosi_Neuman — Wed, 04 Sep 2024 09:40:07 GMT

Hi guys,

Struggle here with Log classic ingest rule Add condition and Matcher attribute of Host tag

We have tag on host

But once adding the condition

logs are not collected any more

What are we missing here ?

Yos

Re: Log (classic) ingest rule , host tag matcher attribute

PedroSantos — Mon, 09 Sep 2024 17:53:36 GMT

Hey Yos, did you manage to figure this out?
We're having a very similar problem where Dynatrace doesn't seem to be able to recognize the tags on a host properly and collect logs from there.

This is the rule I have for the environment and it does not work. The host absolutely has the tag:

But no logs are collected.

However, if I add the following rule to the host itself, the logs are collected:

I have no clue what's going on, since it should be working and had been working in the past. A "workaround" would be to add rules to each and every host individually, but that's a nightmare.

Am I using the wrong syntax or something?

Re: Log (classic) ingest rule , host tag matcher attribute

Yosi_Neuman — Tue, 10 Sep 2024 04:47:14 GMT

Hi @PedroSantos

Nope 🙃 still don't have solution for that

Will open a support ticket for that later on and will update with the answer

Yos

Re: Log (classic) ingest rule , host tag matcher attribute

PedroSantos — Tue, 10 Sep 2024 10:17:30 GMT

Hi @Yosi_Neuman

I think we might have figured out something on our end. It seems that this might be the issue:

Matching is based on the host tag. The attribute only supports the tags set with the OneAgent command line tool or with the Remote configuration in a key=value pair format. They can be distinguished by the [Environment] prefix on the UI, but you should use the value without the prefix. Multiple tags can be specified in a single matcher, but each tag needs to have the same key, such as logscope=frontend, logscope=backend.

So, essentially, none of the tags we were using had the [Environment] prefix on the UI. Can you confirm this is the case on your end as well?

For this purpose, we can only use tags defined through the OneAgent command line tool or applied through the Remote Configuration. What this means is that we'll probably need to reapply tags to several hosts using these tools, and then it should work. From what I've gathered, it seems that tags not applied through these tools are not visible to the OneAgent (and are instead known by the SaaS), and that's why the OneAgents has no idea that the tags we're using are applied to their hosts.

Re: Log (classic) ingest rule , host tag matcher attribute

Yosi_Neuman — Tue, 10 Sep 2024 13:26:36 GMT

Bravo @PedroSantos

I read the documentation and saw the Remote configuration but did not understood that it means we need to go the deployment status page and set the tag from there 😱

Now, after setting the tag its work like a charm! 🤗

Thanks for your help !

All the best and stay safe

Yos

Re: Log (classic) ingest rule , host tag matcher attribute

AntonPineiro — Thu, 06 Feb 2025 09:26:02 GMT

Hi,

I have just raised this product idea. Maybe it would be useful to your usecase.

Best regards