cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to PARSE an unstructured log content skipping \n (newline)

mpundang
Frequent Guest

Hi everyone, I have this log format in a Managed Cluster, with Log Classic, no Grail:

"content": "last access : Wed May 22 11:32:42 ART 2025\\nmax inactive interval : 1800\\nuser name : anonymous\\nvalid session : true\\nnew session : false\\noverflowed : false\\n _refCount=1\\n } \\n _httpSessionContext=com.ibm.ws.session.http.HttpSessionContextImpl@115c1a4a\\n } \\n)\\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,936 DEBUG script.dao.GeneralDAOImpl  findRow(sp_FN_Comprobantes_FNC,{54672,1,50150346002250506,39,})\\nULL1lryN-ZidhtxVbFg09WN 28/05/25 11:32:50,936 DEBUG sam.service.SamSPService  <<<< TM_FEMP_DB2. - RESULTADOS: cursor -> 1 items retornados, P_COD_CLASEORD = TXO, P_COD_CLIECASH = 0026008500002886, p_sqlcode_out = null, P_COD_IDORDEN = 5751BOJN, \\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,936 INFO script.dao.GeneralDAOImpl  \\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,938 INFO script.dao.GeneralDAOImpl  exec sp_FN_Comprobantes_FNC 54672, null, '50150346002250506', '39', null, null, null\\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,938 INFO script.dao.GeneralDAOImpl ",

I need to get the  keyvalue string: c5uZNCXLKmuKjacR5_NNqxK (23 letters). 

The keyvalue appears on multiple lines in the log, and there are even other keys with the same string length that I need to capture. It's always a 23-character string.

I can check after /n (newline) begins with the keyvalue but I cannot get the value with this filter:

PARSE(content, "LD '\n' DATA [a-zA-Z0-9_-]{23}:test")

 

Does anybody knows what is the correct filter to get the keyvalue? and is it possible to get multiple keyvalues from this content log?

Regards!

1 REPLY 1

DanielS
DynaMight Guru
DynaMight Guru

Hello @mpundang a tought one.

n\K[a-zA-Z0-9_-]{23}

 

DanielS_0-1752620569998.png

or another option, less elegant

[^\n]+([a-zA-Z0-9_-]{23})

DanielS_1-1752620706097.png

 

Dynatrace Certified Professional @ www.dosbyte.com

Featured Posts