In the log monitoring section I need to create a new rule that will
collect a specific word, for example the name of the attribute is "requesturl ":
and the outcome contains \*\*\rest\*\ but the convention is not necessarily at the same order , that means that the location for the “rest” can be changed .
The question is if It possible to create a new rule that will display only a specific word and then to present it at the side bar .
Yes, it is possible, for example:FILEDS_ADD(requesturl,"static_word")will add attribute called requesturl with value “static_word”.
In LM Classic to present such attribute in side bar you need to define it in custom attributes settings with enabled option “Show attribute values in side bar”
og.source= “/opt/jboss/var/main.log” AND (content=“error” OR content=“ERROR” OR content=“warning” OR content=“Warning”) - this is our log source. we want to get alert only if first line of content starts with error.
With the above setting, it is generating alerts when there is word “ERROR” in the entire log file