Parse Multiline Log

[MarcioKaue]

Hello,

We are facing a problem parsing log lines where we understand that the root cause is due to the data being multiline.

Below is an example log:

2023-02-31 11:51:28,988 - INFO - Prediction Output: class0_proba=0.00 class1_proba=0.00
INFO: 0.0.0.0:12345 - "POST /api/v1/model/string/predict HTTP/1.1" 200 OK

We would like to parse the Status Code information but it is not being effective:

fetch logs
| filter contains(content, "POST")
| parse content, "LD 'HTTP/1.1\"' LD:httpcode "

In a log that is not multiline this parse works correctly. Does anyone have any idea how we can extract this information?

[sinisa_zubic · Accepted solution]

Hi @MarcioKaue 

The reason why is because LD is only matching one single line. You have to use the DATA matcher, which is the multiline matcher.

| parse content, """DATA 'HTTP/1.1\" ' INT:httpcode"""

Best,
Sini

[MarcioKaue]

Thanks @sinisa_zubic , it worked perfectly!

[MarcioKaue]

@sinisa_zubic ,Can we also get other fields using DATA?

Example get status code and API name "/api/v1/model/string/predict"

[sinisa_zubic · Accepted solution]

yes you can

| parse content, """DATA '"' ALPHA:method ' ' LD:apiName ' HTTP/1.1\" ' INT:httpcode"""

If you are new to the Dynatrace Pattern Language, I would suggest that you check out those two resources

https://www.dynatrace.com/news/blog/speed-up-your-security-investigations-with-dpl-architect/

https://docs.dynatrace.com/docs/platform/grail/dynatrace-pattern-language/dpl-architect

[Kenny_Gillette]

I am trying to figure out DQL/DPL

Stuck on this:

info: cartservice.cartstore.ValkeyCartStore[0]
AddItemAsync called with userId=744108ea-1a14-11f0-b19d-fe219cfda8e5, productId=2ZYFJ3GM2N, quantity=5

Need to pull UserID, productId, and quantity.

Going through a class on university:

https://university.dynatrace.com/ondemand/course/39387/video/36652?content=resources&section=39620

But their example didn't have two lines.  I know to use DATA but just can't figure out.