Exclude word in log injection rules

[alex94]

Hello,

is there a way to exclude word when making a log ingest rules for a host?

For example, I want to include in Storage logs that match "/health/ready" but doens't have "StatusCode: 200". 

How can i write a not matching expression?

Thank you

[Pawel_Zalewski · Accepted solution]

Hi,

There are only 2 options:

1. If no wildcard is used in the value, then the matcher looks for an exact fit to the value.
2. If a wildcard is used, the matcher looks for the exact match.

For example, the value INFO results in sending only the log data having the exact INFO string, but the value *INFO* (using the wildcards) matches log data that contain the INFO string in its content.

[PacoPorro · Accepted solution]

Can I suggest to use 2 rules? 
1st rule should exclude StatusCode: 200
2nd rule should include /health/ready

[alex94]

Thank you for the info!

We are new to Dynatrace and I am currently looking at the different possibilities of ingest rules to make sure we don't keep useless logs because we have a lot of them.

I wanted to know if that was possible to do it with one rules, but i can for sure do it with multiple rules using include and exclude.

[PacoPorro]

As far as I know, it is not possible to use a single rule.
Note that rules are evaluated from top to bottom, which means that exclusion must come before inclusion.