Need Help with String Extraction in DPL

[Akhil-Jayendran]

Hello Team,

I would like to extract only values matching the pattern *appdevgw-***  from below sample logs  data and assign them to a new field named HostName with capital letters, for example: HostName=DAPPDEVGW-001. Is that possible using DPL ?

DATA record(host.name="dappdevgw-001.phx.ad.company.com", message= "this is a test message 1"),

          record(host.name="pappdevgw-006.phx.ad.company.com", message= "this is a test message 2"),

          record(host.name="bappdevgw-007.phx.ad.company.com", message= "this is a test message 3")

Br,

[Akhil-Jayendran · Accepted solution]

I think I found it in a different way. without DPL.

DATA record(host.name="dappdevgw-001.phx.ad.company.com", message= "this is a test message 1"),
record(host.name="pappdevgw-006.phx.ad.company.com", message= "this is a test message 2"),
record(host.name="bappdevgw-007.phx.ad.company.com", message= "this is a test message 3")
| fieldsAdd HostName = splitString(host.name, ".")
| fieldsAdd HostName =arrayFirst(HostName)
| fieldsAdd HostName= upper(HostName)


But I’m curious — is this possible with DPL?

[jmarbaix · Accepted solution]

DPL is only for extraction, not for adapting the string itself. You need to compare it to regular expressions. This means that if you want to do more than just matching/searching and extracting a string, you will need a DQL statement.

A solution with DPL could be:

DATA record(host.name="dappdevgw-001.phx.ad.company.com", message= "this is a test message 1"),
record(host.name="pappdevgw-006.phx.ad.company.com", message= "this is a test message 2"),
record(host.name="bappdevgw-007.phx.ad.company.com", message= "this is a test message 3")
| parse `host.name`, """DATA?
(DATA{1}
'appdevgw-'
DATA{3}):HostName
DATA"""
| fieldsAdd HostName = upper(HostName)