Hi Everyone,
I'm trying to extract a field to convert it into a metric using processing logs.
My log sample is:
{
"event.type": "LOG",
"content": "2025-06-02 15:17:19.015 -05:00 RegistrarProcesoTDAsync solicitado. Parámetros: {\"NumeroTarjeta\":\"4863550000xxxxxx\",\"FechaExpiracion\":\"xxxx\",\"TipoTransaccion\":\"00\",\"PaisTransaccion\":333,\"TipoComercio\":\"0000\",\"ValorDebito\":55.55,\"Descripcion\":\"SUPER CENTRO PA\",\"CompraParcial\":\"N\",\"IdTransaccion\":\"20250FFF-03-461YYY-3634ZZZ-51532000UUUU\",\"TraceID\":\"557XXXX\",\"CodigoCanal\":13}"
}
On processor definition a put the following:
PARSE(content, "LD JSON{INT:CodigoCanal}(flat=true)")
| FIELDS_RENAME(Canal:CodigoCanal)
Then when run test the rule, an error message appears: "The matcher query doesn't match the provided log sample."
Can you help me by telling me what i'm missing?
Thanks in advance
