# Log Processing "CASE" ?

**URL:** <https://community.dynatrace.com/t/log-processing-case/45051>\
**Category:** Open Q&A\
**Tags:** log-processing\
**Created:** [April 8, 2024, 7:44pm UTC](https://community.dynatrace.com/t/log-processing-case/45051 "2024-04-08T19:44:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AntonioSousa](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antoniosousa/32/50_2.png) [@AntonioSousa](https://community.dynatrace.com/u/AntonioSousa)\
**Post date:** [April 8, 2024, 7:44pm UTC](https://community.dynatrace.com/t/log-processing-case/45051/1 "2024-04-08T19:44:02Z")

</div>

When processing a log I have, I need to give an attribute a value based on a single character in the log entries. Basically, I need to do the following translations:

- ‘N’ → North
- ‘S’ → South
- ‘E’ → East
- ‘W’ → West

What would be the best and efficient way to do it?

---

<div class="post-metadata">

**Author:** ![sattilas](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sattilas/32/19702_2.png) [@sattilas](https://community.dynatrace.com/u/sattilas)\
**Post date:** [April 20, 2024, 7:57pm UTC](https://community.dynatrace.com/t/log-processing-case/45051/2 "2024-04-20T19:57:39Z")

</div>

Hi,

I assume it’s Log monitoring classic.

The content of the log for example: “2024.04.20 quarter: N”

First, define “my.quarter” attr. :

USING(INOUT, my.quarter:STRING, content)

Then Parse my.quarter from content:

| PARSE(content,“LD ‘quarter:’ SPACE? STRING:my.quarter”)

Then put transformed value to my.renamed\_quarter if Letter matches:

| FIELDS\_ADD(my.renamed\_quarter: IF\_THEN(my.quarter == ‘N’, ‘NORTH’,))

|&nbsp;FIELDS\_ADD(my.renamed\_quarter: IF\_THEN(my.quarter == ‘S’, ‘SOUTH’,))

|&nbsp;FIELDS\_ADD(my.renamed\_quarter: IF\_THEN(my.quarter == ‘E’, ‘EAST’,))

|&nbsp;FIELDS\_ADD(my.renamed\_quarter: IF\_THEN(my.quarter == ‘W’, ‘WEST’,))

The result looks like this:

{  
“content”: “2024.04.20 quarter: N”  
“timestamp”: “1656011338522”,  
“my.quarter”: “N”,

“my.renamed\_quarter”: “NORTH”  
}

I used this example:

> **[Customize incoming log data with log processing rules](https://docs.dynatrace.com/docs/analyze-explore-automate/log-monitoring/log-processing/log-processing-examples-classic)**
>
> Explore scenarios of how to use log processing rules in Dynatrace powered by Grail.

Best,

Attila