log processing- custom rule

[idand]

Hi Team, 

In the log monitoring section I need to create a new rule that will 

collect a specific word, for example the name of the attribute is "requesturl ":

and the outcome contains \*\*\rest\*\ but the convention is not necessarily at the same order , that means that the location for the "rest"  can be changed . 

The question is if It possible to create a new rule that will display only a specific  word and then to present it at the side bar . 

 Thanks in advance

[MaciejNeumann]

Hello @idand ,

Could you provide us with more information about your issue? Are you using Log Monitoring Classic or Log Management and Analytics powered by Grail?

[idand]

Hi MaciejNeumann , 

We are using Log Monitoring Classic . 

Thanks !

[sundarv1]

Hi

og.source= "/opt/jboss/var/main.log" AND (content="error" OR content="ERROR" OR content="warning" OR content="Warning") - this is our log source. we want to get alert only if first line of content starts with error.

With the above setting, it is generating alerts when there is word "ERROR" in the entire log file

[MaciejNeumann · Accepted solution]

Just got the answer from our developers 🙂 

Yes, it is possible, for example:FILEDS_ADD(requesturl,"static_word")will add attribute called requesturl with value "static_word".
In LM Classic to present such attribute in side bar you need to define it in custom attributes settings with enabled option "Show attribute values in side bar"

[sundarv1]

How to generate alerts from the log file only if first line in the log file has "ORA".