cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

DQL parsing on JSON

ae
Visitor

I have this simple log:

 

Content
{
"HTTP_REQUEST_URL": ".....",
"HTTP_RESPONSE_CODE": 500,
"HTTP_RESPONSE_BODY": "errors",
"CURRENT_URL": "/example"
}
 
I'm trying to get all the http status count that are above 400 example below, but not sure how it works with JSON?
| parse content, "LD 'HTTP_RESPONSE_CODE ' INT:httpstatus"
| filter httpstatus >= 400
| summarize count(), by:{httpstatus}
1 REPLY 1

mark_bley
Dynatrace Champion
Dynatrace Champion

you can easily parse json (mocked some of the data):

data record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 500,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}"),
record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 500,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}"),
record(content="{\"HTTP_REQUEST_URL\": \".....\",\"HTTP_RESPONSE_CODE\": 501,\"HTTP_RESPONSE_BODY\": \"errors\",\"CURRENT_URL\": \"/example\"}")
| parse content, "JSON:http_payload"
| filter http_payload[HTTP_RESPONSE_CODE] >= 400
| summarize count(), by:{http_payload[HTTP_RESPONSE_CODE]}

 

mark_bley_0-1717671437191.png

 

Featured Posts