Set default values in parsing

Comments

5 comments

  • Avatar
    Olaf Stein

    Hi Carlos,

    The best way to do this is just parse the path:

    | parse "/*/*/*?* something *" as path, a, b, c

    Hope this helps

    Olaf

    1
    Comment actions Permalink
  • Avatar
    Carlos Andonaegui

    Turn out that paths are much more complex

    0
    Comment actions Permalink
  • Avatar
    Olaf Stein

    In what regard? We may have to use regex to extract them then...if you have some example I can take a look

    0
    Comment actions Permalink
  • Avatar
    Carlos Andonaegui

    I did it using if let me put the next scenario for Nginx logs

    sample log "POST /path/1 200"


    | parse "\"* /complex/*/endpoint/* *" as method, value1, value2, http_code nodrop
    | parse "\"* /this/*/that *" as method, value1, http_code nodrop
    | parse "\"* /this/*/these *" as method, value1, http_code
    | if(_raw matches "*/complex/*/endpoint/*", "complex_endpoint", "") as path
    | if(_raw matches "*/this/*/that*", "this_that", path) as path
    | if(_raw matches "*/this/*/these*", "this_these", path) as path
    | broup by path, http_code
    | order by path

    I know it may be the hard way but it works. hopefully, in the future, we can use something like:

    | parse "* /something/*/else" as method, value1, "something_else" as path

    it's an idea.

    0
    Comment actions Permalink
  • Avatar
    Olaf Stein

    Carlos,

    couple of things. You can create fields with hardcoded values like this:

    | "something_else" as path

    Since the value here is variable you can use the if operator, as above, or extract the values and build it dynamically. If the paths are too complex to do that the if operator is your best bet.

    Thanks

    Olaf

    0
    Comment actions Permalink

Please sign in to leave a comment.