DQL fields contains list of values

[Nicolas_S]

Hello,

From my logs, i need to add a tag "warning" if the reqPath field contains one of ID like "UID1" "UID2" "UID3" "UID4".
Davis Copilot Answer to this question is :

fetch logs
| fieldsAdd warning = if(contains(reqPath, "UID1") OR contains(reqPath, "UID2") OR contains(reqPath, "UID3") OR contains(reqPath, "UID4"), "warning", else:NULL)

It works but it's not possible to maintain with a list of hundreds of UID.

Is there a way in DQL to search a list of terms in a specific field?

Thanks and regards,

[JeanBlanc]

Hi @Nicolas_S 

Yes, instead of listing each UID with contains(), you can use matchesValue() with wildcards if all your UIDs follow a common pattern.

For example:

fetch logs
| fieldsAdd warning = if(matchesValue(reqPath, "*UID*"), "warning", else:NULL)

This will add the "warning" tag to any log where the reqPath contains something like "UID".

It’s much simpler and easier to maintain when you have many UIDs with a similar format.

Best regards!

[krzysztof_hoja · Accepted solution]

More condensed version of such expressions (together with application example) looks like this:

data record(reqPath="aaaa UID1 bbbb"),
record(reqPath="aaaa UID2 bbbb"),
record(reqPath="aaaa UID3 bbbb"),
record(reqPath="aaaa UID4 bbbb"),
record(reqPath="aaaa UID5 bbbb")
| fieldsAdd warning=if(iAny(contains(reqPath, array("UID1","UID3","UID5")[])),"warning")

 result:

[Nicolas_S]

Hello,

Thank you that's exactly what i was looking for.

The fields values are not UID1 UID2 and so on but real UID like 587a4b2c-9d3e-1f0g, a1b2-c3d4-e5f6-7890, etc which are very difficult to use with DPL or wildcards solutions.

[marco_irmer]

I would recommend using the matchesPattern function for this scenario. This function allows you to test whether the field matches a specific DPL pattern.