Log Monitoring Classic - Parsing and Results Formatting

DynaMight — Fri, 12 May 2023 19:37:51 GMT

Hello Community,

Is there anyway to alter the default results table formatting in the Logs section when any user enters?

Lines per row
What fields are selected

Secondary question related to processing rule using example contents of log below:

"content": "2023-01-01 12:00:00,000 [12] ERROR SourceApp Contract 123456789 is currently being processed (additional text)",

How would you construct processor definition to parse out the remaining content after 'SourceApp ' to end of contents [Contract 123456789 is currently being processed (additional text)] into a field named "message" ?

My goal is to remove unnecessary information at the head of the content field, replaced with message field, to enhance user experience viewing logs from this source.

Thank you!

Re: Log Monitoring Classic - Parsing and Results Formatting

Tomasz_Wozniak — Wed, 07 Jun 2023 07:36:12 GMT

Hi,
I could answer the second question.

The processor definition would be very simple. The `PARSE` command could be used to address that need.

Please try the following script

PARSE(content,"LD 'SourceApp' SPACE DATA:message")

An additional field should be added to the record

topic Re: Log Monitoring Classic - Parsing and Results Formatting in Log Analytics

Log Monitoring Classic - Parsing and Results Formatting

Re: Log Monitoring Classic - Parsing and Results Formatting