24 Nov 2022
09:53 AM
- last edited on
24 Nov 2022
10:05 AM
by
MaciejNeumann
Hi Folks,
Could you please help me?
I have a simple log processing rule:
PARSE(content,"DATA 'processId: '
STRING:obm.process.id
")
This is a sample log record:
"content": "2022-11-24 09:40:00.978 INFO [DefaultMessageListenerContainer-1] [dt.span_id=44674bb73d679f33, dt.trace_id=1cc4cc7291fd055e7b5972f075f436da, dt.trace_sampled=true] h.i.o.mq.service.JmsServiceImpl - Message has been received.\nType: PublishDeviceStatusChangeDg_v2, businessId: 72b08373-fecb-4295-94da-9c9a98418edc, processId: dc486074-7389-4320-be7d-666da9534021, source: EDMAMGMT, destination: null",
This is the obm.process.id result:
"obm.process.id": "dc486074-7389-4320-be7d-666da9534021,"
Is it possible somehow to eliminate the comma from the end of the result without to change the original log structure?
Thanks in advance.
Best regards,
Mizső
Solved! Go to Solution.
Haven't checked, but would it help to continue parsing? Like :
PARSE(content,"DATA 'processId: '
STRING:obm.process.id, 'source: ' STRING:source.id, 'destination: 'STRING:destination")
Hi,
this rule should work for you
PARSE(content,"DATA 'processId: '
[a-z0-9-]*:obm.process.id
")
Best,
Sini
Hi @sinisa_zubic,
Thanks for your replay and help.
The result does not meet the expectation.
Tested with it:
processId: 1C81A74E-0E7C-4B55-A4AC-5BB360FC94E0,
Result:
"obm.process.id": "1"
Best regards,
Mizső
you need to adjust a bit the rule:
PARSE(content,"DATA 'processId: '
[a-zA-Z0-9-]*:obm.process.id
")
In the initially provided example "process id" did not contain any upper case characters, so I added to the character group ([a-zA-Z0-9-]) also uppercase characters.
Best,
Sini
Hi @sinisa_zubic,
Thanks for your help, with a minor chage it works. Becasue it case sensitive.
So this is the correct parse:
Parse(content, "DATA 'processId: '
[A-Z0-9-]*:obm.process.id
")
The source log is a ..... sometimes the id is uppercase sometimes lowercase. 😞
Best regards,
Mizső