DQL for Successful vs Failed Product Transfers by brand (Logs on Grail vs Classic)

[arunshetty2281]

We need to chart Successful vs Failed requests per brand from application logs. The brands are logged in the message body (JSON fragments like "brand":"Bradford"), and success is indicated by "offerAccepted":"Y". This is the example output below — it should look like this:


In Grail/DQL, we can parse and aggregate in a single query. In Logs & Events Classic, we understand aggregation requires Log Processing + Log Metrics rather than inline summarize. I’d like to confirm the best practice for both, and validate the parse/aggregation approach. (Docs I’ve consulted: DQL matcher & parsing, aggregation commands, and Classic Log Monitoring guidance.)

[Mizső]

Hi @arunshetty2281 

Regarding the Log Classic I can confirm that first you should parse out the brand and offerAccepted by log processing, then you can generate a log attribute from them. Finally you should create a log metric (count of occurance) and use this log attributes as dimension of this metric. Then you can create a table in the data explorer from the log metric split by these two dimensions:  first entity selector split by the two dimensions the filter to offerAccepted dimension with Y and the second entity selector should be the same but filter to offerAccepted dimension with N.

I hope it helps.

Best regards,

János