topic Log Processing CASE WHEN THEN ELSE END Documentation in Log Analytics

Log Processing CASE WHEN THEN ELSE END Documentation

36Krazyfists — Tue, 08 Oct 2024 06:04:19 GMT

If you install the F5 Extension it creates a Log Processing rule called F5 Traps Processing and in this rule it has CASE statements. A lot of them...

The problem is, how'd they know how to use those?

I've searched and searched and nowhere in the documentation can I find any reference to CASE statements as being a valid function to use.

Even the IF, IF_THEN, IF_THEN_ELSE statements on the Log processing functions documentation is kind of hidden under an obscure term known as "Flow-control" (despite nearly every other single function being clearly listed in the right-hand bookmarks list).

But I digress...

As you can see in this screenshot:

This rule extensively utilizes the CASE statement yet I don't know how they knew to do that nor can I find any documentation on it myself...

Anybody got a link to the docs for this, or is this just some old deprecated function that is going away but still works?

Re: Log Processing CASE WHEN THEN ELSE END Documentation

jaume_reverte — Tue, 08 Oct 2024 15:15:26 GMT

Hello 36Krazyfists,

It's true that it is not documented. I informed internally about it, and I'll let you know when I have an update.

Thank you for the spot!

Hope you a good monitoring!

Re: Log Processing CASE WHEN THEN ELSE END Documentation

SG88 — Thu, 10 Oct 2024 03:39:35 GMT

Thanks for posting this up - just reconfigured some of my processing rules to make them a bit easier to follow.

Updated documentation would be great for future reference, and there might be other functions we can use too!