Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON

Platform DQL
, , ,
1

is it possible to add a field to logs by check if a KEY exist in a Parsed JSON while processing logs,

JSON SAMPLE :
{

“name” : “test”

“action” : “some random string”

…

…

}

requirement : add a new_feild as log attribute if json contains a key named “action”

PARSE(content,“JSON:data”) |
FIELDS_ADD( new_feild: IF{ ??? })

2

Hi @pallepavan

Yep, you can do that. You don’t even need to parse your json, assuming the string ‘action’ is not present anywhere.

|fieldsAdd hasaction = contains(content,“action”)

This will add a ‘hasaction’ field as boolean (true/false) to your results. Then you can use it in your IF condition, to add a new field with some other log attribute.

Check this doc to get more details: DQL functions — Dynatrace Docs