topic Re: Log processing parse in Log Analytics

Log processing parse

Mizső — Thu, 24 Nov 2022 10:05:59 GMT

Hi Folks,

Could you please help me?

I have a simple log processing rule:

PARSE(content,"DATA 'processId: '

STRING:obm.process.id

This is a sample log record:

"content": "2022-11-24 09:40:00.978 INFO [DefaultMessageListenerContainer-1] [dt.span_id=44674bb73d679f33, dt.trace_id=1cc4cc7291fd055e7b5972f075f436da, dt.trace_sampled=true] h.i.o.mq.service.JmsServiceImpl - Message has been received.\nType: PublishDeviceStatusChangeDg_v2, businessId: 72b08373-fecb-4295-94da-9c9a98418edc, processId: dc486074-7389-4320-be7d-666da9534021, source: EDMAMGMT, destination: null",

This is the obm.process.id result:

"obm.process.id": "dc486074-7389-4320-be7d-666da9534021,"

Is it possible somehow to eliminate the comma from the end of the result without to change the original log structure?

Thanks in advance.

Best regards,

Mizső

Re: Log processing parse

Radoslaw_Szulgo — Thu, 24 Nov 2022 10:36:53 GMT

Haven't checked, but would it help to continue parsing? Like :

PARSE(content,"DATA 'processId: '

STRING:obm.process.id, 'source: ' STRING:source.id, 'destination: 'STRING:destination")

Re: Log processing parse

sinisa_zubic — Thu, 24 Nov 2022 12:21:00 GMT

Hi,

this rule should work for you

PARSE(content,"DATA 'processId: ' [a-z0-9-]*:obm.process.id ")

Best,

Sini

Re: Log processing parse

Mizső — Thu, 24 Nov 2022 12:34:56 GMT

Hi @sinisa_zubic,

Thanks for your replay and help.

The result does not meet the expectation.

Tested with it:

processId: 1C81A74E-0E7C-4B55-A4AC-5BB360FC94E0,

Result:

"obm.process.id": "1"

Best regards,

Mizső

Re: Log processing parse

sinisa_zubic — Thu, 24 Nov 2022 12:42:36 GMT

you need to adjust a bit the rule:

PARSE(content,"DATA 'processId: ' [a-zA-Z0-9-]*:obm.process.id ")

In the initially provided example "process id" did not contain any upper case characters, so I added to the character group ([a-zA-Z0-9-]) also uppercase characters.

Best,

Sini

Re: Log processing parse

Mizső — Thu, 24 Nov 2022 12:46:01 GMT

Hi @sinisa_zubic,

Thanks for your help, with a minor chage it works. Becasue it case sensitive.

So this is the correct parse:

Parse(content, "DATA 'processId: '

[A-Z0-9-]*:obm.process.id

The source log is a ..... sometimes the id is uppercase sometimes lowercase. 😞

Best regards,

Mizső

Re: Log processing parse

Babar_Qayyum — Tue, 10 Dec 2024 09:58:12 GMT

Hello @sinisa_zubic

I require your help in interpreting an error code for parsing/presentation as a table field.

2024-12-10 09:44:45.255 ERROR [users,CIBW,9f812ead596fb3f1fb1c3c10e0ffafb5,8a17037d4d18df4a,CIBW12100943945135fe9f48ab6b346d56b,http-nio-8080-exec-6] com.abcdefg.ib.commons.advice.ErrorAdvice.handleIntegrationException:92 | Boom! Code: E000000, Message:E000000,

Regards,

Babar