Log processing parse

[Mizső]

Hi Folks,

Could you please help me?

I have a simple log processing rule:

PARSE(content,"DATA 'processId: '

STRING:obm.process.id

")

This is a sample log record:

"content": "2022-11-24 09:40:00.978 INFO [DefaultMessageListenerContainer-1] [dt.span_id=44674bb73d679f33, dt.trace_id=1cc4cc7291fd055e7b5972f075f436da, dt.trace_sampled=true] h.i.o.mq.service.JmsServiceImpl - Message has been received.\nType: PublishDeviceStatusChangeDg_v2, businessId: 72b08373-fecb-4295-94da-9c9a98418edc, processId: dc486074-7389-4320-be7d-666da9534021, source: EDMAMGMT, destination: null",

This is the obm.process.id result:

"obm.process.id": "dc486074-7389-4320-be7d-666da9534021,"

Is it possible somehow to eliminate the comma from the end of the result without to change the original log structure?

Thanks in advance.

Best regards,

Mizső

[Radoslaw_Szulgo]

Haven't checked, but would it help to continue parsing? Like :

PARSE(content,"DATA 'processId: '

STRING:obm.process.id, 'source: ' STRING:source.id, 'destination: 'STRING:destination")

[sinisa_zubic · Accepted solution]

Hi,

this rule should work for you

PARSE(content,"DATA 'processId: '
[a-z0-9-]*:obm.process.id
")

Best,

Sini

[Mizső]

Hi @sinisa_zubic,

Thanks for your replay and help.

The result does not meet the expectation.

Tested with it:

processId: 1C81A74E-0E7C-4B55-A4AC-5BB360FC94E0,

Result:

"obm.process.id": "1"

Best regards,

Mizső

[sinisa_zubic · Accepted solution]

you need to adjust a bit the rule:

PARSE(content,"DATA 'processId: '
[a-zA-Z0-9-]*:obm.process.id
")

In the initially provided example "process id" did not contain any upper case characters, so I added to the character group ([a-zA-Z0-9-]) also uppercase characters.

Best,

Sini

[Mizső]

Hi @sinisa_zubic,

Thanks for your help, with a minor chage it works. Becasue it case sensitive.

So this is the correct parse:

Parse(content, "DATA 'processId: '

[A-Z0-9-]*:obm.process.id

")

The source log is a ..... sometimes the id is uppercase sometimes lowercase. 😞

Best regards,

Mizső

[Babar_Qayyum]

Hello @sinisa_zubic 

I require your help in interpreting an error code for parsing/presentation as a table field.

2024-12-10 09:44:45.255 ERROR [users,CIBW,9f812ead596fb3f1fb1c3c10e0ffafb5,8a17037d4d18df4a,CIBW12100943945135fe9f48ab6b346d56b,http-nio-8080-exec-6] com.abcdefg.ib.commons.advice.ErrorAdvice.handleIntegrationException:92 | Boom! Code: E000000, Message:E000000,

Regards,

Babar