Use the negation operator in DPL

[educampver]

Hi,

How can we use the negation operator in DPL? For instance, in the example below, the DataKey is always a string of 24 digits. It is essentially a timestamp followed by an identifier. I need to check log records when this DataKey is malformed or has a length of less than 24 characters. Example log record:

<TaskQueue ... DataKey="202303281310073066696996">
  ...
</TaskQueue>

Thanks in advance. 

[sinisa_zubic · Accepted solution]

Hi there,

please have a look at following query

data record(content="""<TaskQueue DataKey="202303281310073066696997"></TaskQueue>""")
| parse content, "DATA 'DataKey=' DQS:datakey"
| parse datakey, "TIMESTAMP('YYYYMMddHHmmssSSSSS'):date"
| parse datakey, "[0-9]{24}:numandlength"
| fieldsAdd malformed = if(isNull(datakey),true,else:false)
| fieldsAdd malformed = if(isNull(date),true,else:malformed)
| fieldsAdd malformed = if(isNull(numandlength),true,else:malformed )
| fieldsAdd malformed = if(Stringlength(datakey)!=24,true,else:malformed)

some explanation

• fist lets parse and extract the DataKey from the content. It is within a double-quoted string (therefore the DQS matcher)
• then let's parse the and extract DataKey to date and as well to a 24 digits long number
• afterward you check if any of those fields isNull. If yes, you set malformed to true

Best,
Sini