Log processing rules : how to set newfeild=success by checking if a key exist in Parsed JSON

[pallepavan]

is it possible to add a field to logs by check if a KEY exist in a Parsed JSON while processing logs, 

JSON SAMPLE :
{

"name" : "test"

"action" : "some random string"

...

...

}

requirement : add a new_feild as log attribute if json contains a key named "action"

PARSE(content,"JSON:data") |
FIELDS_ADD( new_feild: IF{ ???? })

[dannemca · Accepted solution]

Hi @pallepavan 

Yep, you can do that. You don't even need to parse your json, assuming the string 'action' is not present anywhere.

|fieldsAdd hasaction = contains(content,"action")

This will add a 'hasaction' field as boolean (true/false) to your results. Then you can use it in your IF condition, to add a new field with some other log attribute.

Check this doc to get more details: https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/functions#if