Log metric extraction not working

[DamianG]

Hi all,

I have the SQL Extension running on my environment, adding logs automatically. I would like to extract a value from the logs using log metrics, but it is not working.

• Sample logs:

• Log details: some entries contains details of the SQL "largest_files", as attributes (such as file_name, file_size):

I created a processing rule but it is not working:

where I used <<content="\\MSSQL\\DATA\\">> as filter for the log entries. I'm using the attributes included in each log entry, but metric extraction rule is not working:

What I'm doing wrong?

Thank you.

[AntonPineiro]

Hi,

Which value do you want to extract?

I would create processing rule from log viewer:

Because it would add log content in rule for testing:

And you can create processor definition and test rule, as preview. And you can save it when you see it is working as expected.

Best regards

[DamianG]

Hi,

I've created the processing rule using log viewer as you said. In addition, I've created a processor definition, based in the automatic log content in rule for testing:

I think this step should not be needed, as the log content is based in attributes added automatically by the log monitoring:

Anyway, the processing rule is created and, after that, the "Metrics extraction" rule as follows:

Attribute "file_name", "database", "file_size" and "server" are already visible automatically in the Log Viewer, as mentioned before, and also included in the log processing rule.  But the metric is not available yet.

Thank you.

[AntonPineiro · Accepted solution]

Hi,

As it is a metric, can you try to add file_size as attribute? It means, file_size as attribute, and file_name as dimension.

Just to try as file_size is INT value, maybe does not like to add STRING as metric.

Best regards

[DamianG]

Hi,

Good point! I've changed as suggested (file_size as attribute) and now it is working:

Thank you so much for your help!

Regards

[AntonPineiro]

Hi,

I was not sure 100% but and I will remember it for sure! 😉

Best regards