Apply Variables in Dynatrace DQL Filters Using matchesPhrase

[pditmar2]

Summary: Wildcard searches in Dynatrace can be challenging because DQL requires string variables to be enclosed in quotation marks. To work around this, use the concat function to add wildcards around the variable. Example DQL:

fetch logs
| filter matchesValue(content, concat("*", $requestId, "*")) AND matchesValue(content, "* RequestId=*")

I am trying to use a variable in a filter in DQL on my dashboard.

The $requestId variable is created as following :

fetch logs
| filter matchesValue(content, "* RequestId=*")
| parse content, "LD ' RequestId=' [a-zA-Z0-9]*:requestId",
    parsingPrerequisite: contains(content," RequestId=")
//| fields requestId2 = toUid(requestId)
| filterOut requestId == "null"
| summarize distinctrequestId = collectDistinct(requestId)
| expand distinctrequestId
| sort distinctrequestId

The results of the variable query are for example :

09b4597940e040caaa5fd3a2b5801451

27c9e98b933b42a4b7d27923c52c8235

299a6d18441a42b9a0b3a5c6dc22b1a9

On my dashboard I try to apply a filter on the $requestId as following :

fetch logs
| filter matchesValue(content, "*$requestId*") AND matchesValue(content, "* RequestId=*")
​

Unfortunately I run into the following error :

      "errorType": "PARSE_ERROR",
      "errorMessage": "`e9d2e0eb03eb48449fef78e6fe9d7130` isn't allowed here. Please check the autocomplete suggestions before the error for alternative options.",
      "arguments": [
        "`e9d2e0eb03eb48449fef78e6fe9d7130`"
      ],
      "queryString": "fetch logs\n| filter matchesValue(content, \"*\"e9d2e0eb03eb48449fef78e6fe9d7130\"*\") AND matchesValue(content, \"* RequestId=*\")",
      "errorMessageFormatSpecifierTypes": [
        "INPUT_QUERY_PART"
      ],

If I remove the $variable and just add one of the results it works fine. The problem seems to be that the \" that are added around the variable.

Is there any way to fix this? 

Thanks,

Patrick

[marco_irmer · Accepted solution]

It's a bit tricky because you're attempting to do a wildcard search here, whereas Dynatrace insists on enclosing the string variable value in quotations during query executions.

As a workaround, I recommend using the concat function to wrap the variable value in wildcards. The revised DQL will look like this:

fetch logs
| filter matchesValue(content, concat("*", $requestId, "*")) AND matchesValue(content, "* RequestId=*")

[pditmar2]

Thanks a lot, that works!