# log processing- custom rule

**URL:** <https://community.dynatrace.com/t/log-processing-custom-rule/38746>\
**Category:** Logs\
**Tags:** log-processing, log-monitoring-class\
**Created:** [March 8, 2023, 4:01pm UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746 "2023-03-08T16:01:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![idand](https://avatars.discourse-cdn.com/v4/letter/i/49beb7/32.png) [@idand](https://community.dynatrace.com/u/idand)\
**Post date:** [March 8, 2023, 4:01pm UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746/1 "2023-03-08T16:01:02Z")

</div>

Hi Team,

In the log monitoring section I need to create a new rule that will

collect a specific word, for example the name of the attribute is "requesturl ":

and the outcome contains \*\*\rest\*\ but the convention is not necessarily at the same order , that means that the location for the “rest”&nbsp; can be changed .

The question is if It possible to create a new rule that will display only a specific&nbsp; word and then to present it at the side bar .

Thanks in advance

---

<div class="post-metadata">

**Author:** ![MaciejNeumann](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@MaciejNeumann](https://community.dynatrace.com/u/MaciejNeumann)\
**Post date:** [May 12, 2023, 12:15pm UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746/2 "2023-05-12T12:15:16Z")

</div>

Hello&nbsp;[@idand](https://community.dynatrace.com/user/57372)&nbsp;,

Could you provide us with more information about your issue? Are you using [Log Monitoring Classic](https://www.dynatrace.com/support/help/shortlink/log-monitoring-hub) or [Log Management and Analytics powered by Grail](https://www.dynatrace.com/support/help/shortlink/log-management-and-analytics)?

---

<div class="post-metadata">

**Author:** ![idand](https://avatars.discourse-cdn.com/v4/letter/i/49beb7/32.png) [@idand](https://community.dynatrace.com/u/idand)\
**Post date:** [May 14, 2023, 5:40am UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746/3 "2023-05-14T05:40:20Z")

</div>

Hi MaciejNeumann ,

We are using Log Monitoring Classic .

Thanks !

---

<div class="post-metadata">

**Author:** ![MaciejNeumann](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@MaciejNeumann](https://community.dynatrace.com/u/MaciejNeumann)\
**Post date:** [May 15, 2023, 9:51am UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746/4 "2023-05-15T09:51:24Z")

</div>

Just got the answer from our developers 🙂

Yes, it is possible, for example:`FILEDS_ADD(requesturl,"static_word")`will add attribute called requesturl with value “static\_word”.  
In LM Classic to present such attribute in side bar you need to define it in custom attributes settings with enabled option “Show attribute values in side bar”

 ![image (5).png](https://global.discourse-cdn.com/dynatrace/original/3X/4/8/48b6125e1a18266fc324dd4781db4d7e5614ce35.png)

---

<div class="post-metadata">

**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\
**Post date:** [April 18, 2024, 2:19pm UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746/5 "2024-04-18T14:19:52Z")

</div>

Hi

og.source= “/opt/jboss/var/main.log” AND (content=“error” OR content=“ERROR” OR content=“warning” OR content=“Warning”) - this is our log source. we want to get alert only if first line of content starts with error.

With the above setting, it is generating alerts when there is word “ERROR” in the entire log file

---

<div class="post-metadata">

**Author:** ![sundarv1](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@sundarv1](https://community.dynatrace.com/u/sundarv1)\
**Post date:** [April 18, 2024, 2:56pm UTC](https://community.dynatrace.com/t/log-processing-custom-rule/38746/6 "2024-04-18T14:56:17Z")

</div>

How to generate alerts from the log file only if first line in the log file has “ORA”.