Log processing parse

[Mizső]

Hi Folks,

Could you please help me?

I have a simple log processing rule:

PARSE(content,"DATA 'processId: '

STRING:obm.process.id

")

This is a sample log record:

"content": "2022-11-24 09:40:00.978 INFO [DefaultMessageListenerContainer-1] [dt.span_id=44674bb73d679f33, dt.trace_id=1cc4cc7291fd055e7b5972f075f436da, dt.trace_sampled=true] h.i.o.mq.service.JmsServiceImpl - Message has been received.\nType: PublishDeviceStatusChangeDg_v2, businessId: 72b08373-fecb-4295-94da-9c9a98418edc, processId: dc486074-7389-4320-be7d-666da9534021, source: EDMAMGMT, destination: null",

This is the obm.process.id result:

"obm.process.id": "dc486074-7389-4320-be7d-666da9534021,"

Is it possible somehow to eliminate the comma from the end of the result without to change the original log structure?

Thanks in advance.

Best regards,

Mizső

[Radoslaw_Szulgo]

Haven't checked, but would it help to continue parsing? Like :

PARSE(content,"DATA 'processId: '

STRING:obm.process.id, 'source: ' STRING:source.id, 'destination: 'STRING:destination")

[sinisa_zubic · Accepted solution]

Hi,

this rule should work for you

PARSE(content,"DATA 'processId: '
[a-z0-9-]*:obm.process.id
")

Best,

Sini

[Mizső]

Hi @sinisa_zubic,

Thanks for your replay and help.

The result does not meet the expectation.

Tested with it:

processId: 1C81A74E-0E7C-4B55-A4AC-5BB360FC94E0,

Result:

"obm.process.id": "1"

Best regards,

Mizső

[sinisa_zubic · Accepted solution]

you need to adjust a bit the rule:

PARSE(content,"DATA 'processId: '
[a-zA-Z0-9-]*:obm.process.id
")

In the initially provided example "process id" did not contain any upper case characters, so I added to the character group ([a-zA-Z0-9-]) also uppercase characters.

Best,

Sini

[Mizső]

Hi @sinisa_zubic,

Thanks for your help, with a minor chage it works. Becasue it case sensitive.

So this is the correct parse:

Parse(content, "DATA 'processId: '

[A-Z0-9-]*:obm.process.id

")

The source log is a ..... sometimes the id is uppercase sometimes lowercase. 😞

Best regards,

Mizső