DQL - replacing all hexadecimal pattern

[y_buccellato]

Good morning community,

is there an easy way to replace any hexadecimal  pattern from the text of a field?

Example:

com.sap.it.rt.adapter.http.api.exception.HttpResponseException: An internal server error occured: HTTP operation failed invoking https://arturo.ciao.dynamics.com/api/data/v9.2/cchct_INTEGR_aaaa_bbbb_IN?MessageId=*&QueueId=2E5C906617521EDC&QualityOfService=ExactlyOnce with statusCode: 400.

How can I replace this value 2E5C906617521EDC in any log line via DQL?

Regards

[krzysztof_hoja · Accepted solution]

There are replaceString and replacePattern functions which can be helpful. I guess you want to replace not this specific value (2E5C906617521EDC), but similarly looking numbers, so the second one will be more suited.

Please note that besides example you gave there are many more hex numbers in the log line, so very simple pattern would replace too much:

To make it work we need to tell parser more, e.g. what is the surrounding of the number, e.g.:

data record(content="""com.sap.it.rt.adapter.http.api.exception.HttpResponseException: An internal server error occured: HTTP operation failed invoking https://arturo.ciao.dynamics.com/api/data/v9.2/cchct_INTEGR_aaaa_bbbb_IN?MessageId=*&QueueId=2E5C906617521EDC&QualityOfService=ExactlyOnce with statusCode: 400.""")
| fieldsAdd content_fixed=replacePattern(content, "'QueueId='HEXLONG", "QueueId=*")

The result look like: