Log Processing "CASE" ?

[AntonioSousa]

When processing a log I have, I need to give an attribute a value based on a single character in the log entries. Basically, I need to do the following translations:

• 'N' -> North
• 'S' -> South
• 'E' -> East
• 'W' -> West

What would be the best and efficient way to do it?

[sattilas · Accepted solution]

Hi,

I assume it's Log monitoring classic.

The content of the log for example: "2024.04.20 quarter: N"

First, define "my.quarter" attr. :

USING(INOUT, my.quarter:STRING, content) 

Then Parse my.quarter from content:

| PARSE(content,"LD 'quarter:' SPACE? STRING:my.quarter")

Then put transformed value to my.renamed_quarter if Letter matches:

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'N', 'NORTH',))

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'S', 'SOUTH',))

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'E', 'EAST',))

| FIELDS_ADD(my.renamed_quarter: IF_THEN(my.quarter == 'W', 'WEST',))

The result looks like this:

{
"content": "2024.04.20 quarter: N"
"timestamp": "1656011338522",
"my.quarter": "N",

"my.renamed_quarter": "NORTH"
}

I used this example: 

https://docs.dynatrace.com/docs/shortlink/log-monitoring-log-processing-examples#lpexample8

Best,

Attila