Managed : log Classic: How to filter on attributes ?

[gilles_tabary]

Hello.

On Managed, log viewer, classic. I need to filter events on "Other" attributes. My Other attributes are visible in the list only in Advanced Mode, yet I cannot filiter on them. In basic mode, they are not listed as attributes, and I also cannot filter on them.

It loooks like I have a line of log but I cannot grep search for it even though it's in front oyf my eye.

The docs log-monitoring-log-viewer#available-attributes ; lma-log-processing-examples don't help.

How to do that ?

For example I'd like to write 

dt.entity.custom_device="custom_device-1a53c9db3ece27b6" AND loglevel="none" AND event.type="log" AND alerts="Watchdog"

# By the way my alerts attribute value is : 

[{'status': 'resolved', 'labels': {'alertname': 'Watchdog', 'xxx_managed_cluster_name': 'local-cluster', 'managed_cluster': 'xxxxx-2852-44d3-a99e-xxxxxx', 'namespace': 'openshift-monitoring', 'openshift_io_alert_source': 'platform', 'prometh

How to do that ?

Regards

[p_devulapalli]

@gilles_tabary I think you need to parse that content and add it as a field before being able to use it as a filter 

[AntonPineiro]

Hi,

As that is coming by alertmanager, maybe you had already some integration available in Hub.

Anyway, I would say creating your custom log attributes and creating processing rules to parse and scrape those values.

Best regards

[gilles_tabary]

Thanks for feedbacks.