Which DPL syntax is applicable?

[WellPP]

I am creating a processing rule through MATCHER:

matchesPhrase(content, "setFinalReturnCustomerState") AND dt.entity.cloud_application == "CLOUD_APPLICATION-"

I get the log line that has the content:

{
"@timestamp": "2023-12-13T20:06:07.833+00:00",
"level": "INFO",
"severity": "INFO",
"service": "customer",
"message": "setFinalReturnCustomerState - Customer 11111111111 is Active Open Sea",
"stack_trace": ""
}

I need the information that comes after "is", which could be: Quarantine, Open Sea, No Open Sea.

With this I will create a processing rule for this to become a dimension in my metric. I tried to use DPL Arquiteto but I was not successful in the syntax.

[gbaudart · Accepted solution]

Hi @WellPP ,

You can try to add :

| parse content, "LD 'is' STRING:VARIABLENAME"
| fields VARIABLENAME

Let me know it's work 🙂

[gilgi]

Actually I would have even do one more step and parsing the content into a JSON object so that you're sure you're parsing only the message itself. something like:

| parse content, "JSON:parsedJsonObj"
| parse parsedJsonObj[message],  "LD 'is' STRING:customerName"
| fieldsRemove parsedJsonObj