topic Overriding log event status in Log Analytics

Overriding log event status

MartyM — Wed, 02 Nov 2022 08:36:21 GMT

I have written a log processing rule to parse a log file. Some log events have a secondary event log level that can be different from primary log level. I want to set both the event's loglevel and status to the secondary log level. When I test the rule it works perfectly, setting both the loglevel and status to "WARNING" using a FIELD_ADD. However, when that rule is used to ingest the log data both fields are set to "NONE". Is there something more I need to do?

Re: Overriding log event status

ChadTurner — Fri, 20 Jan 2023 15:09:04 GMT

@MartyM were you able to get this issue resolved?

Re: Overriding log event status

MartyM — Mon, 23 Jan 2023 14:49:14 GMT

@ChadTurner Yes, I just needed to another command to update the status field.

// Make sure the loglevel matches the event status

| FIELDS_ADD(status:UPPER(loglevel))