DQL+ DPL summarize

[y_buccellato]

Good afternoon community,

I'm trying to summarize the count of some exception - everything it's easy but some exception may vary based on some ID contained in the text. For example:

Inbound processing in endpoint at /IOM/**** failed with message "Fault:Sequential processing failed for number 0. Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"

Is there a way with a combination of DQL and DPL, or just one of the two to say "If field containing exception with: [ID-**] then keep the everything as it is but just transform [ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098] into [ID-*]" ?

Regards

[krzysztof_hoja · Accepted solution]

Yes, it is possible with combination of couple of functions. I used example line and created 5 log lines out it with different IDs (2+2+1)

data record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""),
record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""),
record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-99cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""),
record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-88cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded"""),
record(content="""Fault:Sequential processing failed for number 0. Exchange[ID-88cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]. Caused by: [org.springframework.jms.ResourceAllocationException - Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded); nested exception is javax.jms.ResourceAllocationException: Error creating session - max transacted sessions exceeded (503: Max Transacted Sessions Exceeded)]", caused by "JCSMPErrorResponseException:503: Max Transacted Sessions Exceeded""")

| fieldsAdd content = if( matchesPhrase(content, "Exchange[ID-56cdd22f-5910-4be0-5f99-2c2c-1721602311434-40-375098]"), content, else: replacePattern(content, "'Exchange[ID' LD ']'", "Exchange[ID-*]" ) )
| summarize {cnt=count()}, by: {content}

If line contains given ID, I leave it without modifications. In other cases I use replacePattern function to modify content and remove not needed ID. After this operation when I summarize by content I just get 2 groups

I hope I understood the need correctly

Kris

[y_buccellato]

I adapted it based on your clear explanation given your understanding and it works perfectly.

Thank you