Log viewer (Logs Classic) : grepping log

[gilles_tabary]

Hello.

On Managed 1.286.86.20240314-161238, Log viewer (Logs Classic). I have some log lines like :

240408 15:35:42,538 [https-jsse-nio-x.y.z.t-8443-exec-72] [xx1234] [1234567890,abcdef] INFO  c.b.a.w.c.f.LoggingRequestAuditFilter - GET /xxx/v1/ws/products/zt123456 - execution time: 4ms - Status 200

I must be doing something wrong somehow, because I cannot find how to search all lines containing for example string [bcde] or [t123] or [45678]. I looked in the doc https://docs.dynatrace.com/docs/shortlink/log-monitoring-log-viewer yet, no way. Even in advanced mode. This is such a basic need : "search for a string in a log file" that I must be missing something extremely trivial. Can someone help ?

Regards.

[gilles_tabary]

To be as specific as possible, the search I am after is "sub-string" search

[Suryanto_1]

Have u tried ?

matchesPhrase(content, "45678") 

[gilles_tabary]

Hello.

I tried matchesPhrase() here (Managed), the predicate is not recognised, even in advanced mode.

AFAIU matchesPhrase() is available in DQL in logs with Dynatrace on Grail, i.e. not on Managed https://docs.dynatrace.com/docs/shortlink/lma-log-processing-matcher.

Any other lead ?

Regards.

[marcin_okraszew · Accepted solution]

Log Classic allows you to search only by tokens, so you need to search for full words, separated by punctuation, spaces, etc. You can also search with beginning of a token, if you add asterisk.

Searching by any substring is only possible in logs powered by Grail. Then you need to use `contains` function. The suggested matchesPhrase() function works also on tokens, similarly to Classic (though, there are some differences).

[gilles_tabary · Accepted solution]

That's an information : It is not possible to grep in Log Viewer Classic, Managed ! People here starts doing funny things to just be able to grep their logs. Which defeat quite a bit of the interest.

Log analysing wise, it looks to me like a unexpectable functionality loss (or regression) between Log V1 to Log V2. People here are baffled, thinking of maybe other solutions.

Thanks for feedack.

[gilles_tabary]

For the record, these search criteria won't return any line (on Managed) :

content="123456789" # missing token trailing 0
content="234567890" # missing token leading 1
content="*234567890" # leading wild-card not processed
content="*23456789*" # leading wild-card not processed
content="23456789*" # trailing wild.card processed fine, yet missing token leading 1 (not replaceable by wildcard)

this will return lines :

content="123456*" 

[sundarv1]

How to search in the content when first line in the log file has "ORA".