Parsing rules -- occurrence negation

[MartinBurgos]

Hi team,

I need a helping hand with the following DQL parsing.

| PARSE content, "
DATA{1,70000}?
(
('tenantId'|'tenant '|'tenant'|'TenantID'|'TenantId'|'tenantID'|'tenant_id'| 'tenant id'| 'tenant ID'|'Tenant ID'|'Tenant Id')
('\\\\\\\\\\\\\"'|'\\\\\\\\\\\"'|'\\\\\\\\\"'|'\\\\\\\"'|'\\\\\"'|'\\\"'|'\"')? SPACE? [:|=]? SPACE?
('\\\\\\\\\\\\\"'|'\\\\\\\\\\\"'|'\\\\\\\\\"'|'\\\\\\\"'|'\\\\\"'|'\\\"'|'\"')? ([a-zA-Z0-9-_{*}]{32}:tenantID)
('\\\\\\\\\\\\\"'|'\\\\\\\\\\\"'|'\\\\\\\\\"'|'\\\\\\\"'|'\\\\\"'|'\\\"'|'\"')?
)
"

I need to fetch all the occurrences I have as tenantId but I should skip _tenant_ and try to fetch  the next thing (i.e. negate underscores before tenant):

This is an example:

{
  "Label": "messagingListener/processTrigger/processEvent",
  "caller": "generic_subscription.go:411",
  "level": "info",
  "message": "execution doesn't exist in db, proceeding to create it...",
  "periodType": "month",
  "resourceAction": "reload",
  "resourceType": "app",
  "scopemapping": "tenant",
  "spanID": "123412341234",
  "taskId": "123412341234",
  "taskdescription": "v1.app.reload.finished consumption context with tenant, resourceType, resourceAction scope",
  "taskname": "app_v1_reload_finished_with_tenant_resourceType_resourceAction_scope",
  "tenantId": "example-tfEokyGtBk7skpV3-example",
  "timestamp": "2023-11-27T10:00:25.032214397Z",
  "traceID": "km12mkl123mkl"
}

The outcome of what I am trying to parse should be "example-tfEokyGtBk7skpV3-example".

Please note that I can't parse the content as JSON because I'll be applying this to other

Could you please help me with it?
Thanks in advance!

[Eric_Yu · Accepted solution]

If you're just trying to extract that portion of the payload you can do something like this:

parse fieldToParse, "DATA '\"tenantId\": \"' DATA:tenantId '\",' DATA"

 
Example:

Let me know if that helps.

[MartinBurgos]

Thanks Eric but unfortunately it does not apply to my real use case.

I have at least one hundred variations and I have found that whenever I have an underscore (e.g. _TenantID,_tenantID,_tenant, etc) it'll fetch the wrong string.

Would it be possible to negate the underscore? As the example below to skip _tenant_

Thanks in advance

[sinisa_zubic]

Hi @MartinBurgos 

yes there is a negative look ahead modifier

does this DPL work for you

$tenant = '"'('tenantId'|'tenant '|'tenant'|'TenantID'|'TenantID'|'tenant_id'|'tenant id'|'tenant ID'|'Tenant ID'|'Tenant Id') '"'!>>(','|'_'|EOL);
$tenantId = [a-zA-Z0-9-_{*}]{32};
DATA{1,15000} $tenant DATA? '"' $tenantId '"'

Best,
Sini

[MartinBurgos]

Hi @sinisa_zubic,

I was OoO, thanks for the help but it unfortunately, I need to maintain the same structure and if I try to add  !<<('_') , it doesn't work.

| PARSE content, "
DATA{1,70000}?
(
('tenantId'|'tenant '|'tenant'|'TenantID'|'TenantId'|'tenantID'|'tenant_id'| 'tenant id'| 'tenant ID'|'Tenant ID'|'Tenant Id')
('\\\\\\\\\\\\\"'|'\\\\\\\\\\\"'|'\\\\\\\\\"'|'\\\\\\\"'|'\\\\\"'|'\\\"'|'\"')? SPACE? [:|=]? SPACE?
('\\\\\\\\\\\\\"'|'\\\\\\\\\\\"'|'\\\\\\\\\"'|'\\\\\\\"'|'\\\\\"'|'\\\"'|'\"')? ([a-zA-Z0-9-_{*}]{32}:tenantID)
('\\\\\\\\\\\\\"'|'\\\\\\\\\\\"'|'\\\\\\\\\"'|'\\\\\\\"'|'\\\\\"'|'\\\"'|'\"')?
)
"

 To provide you with more context, I need to skip if tenant starts with an underscore like --> _tenantID or _tenant or _tenant_Id

I hope this provides you with some clarification and thanks for the help!