Set default values in parsing

Follow

Carlos Andonaegui

• August 24, 2017 18:12

What I want to do is very simple Im doing this.

fyi Iim not using regex

| parse "/endpoint/*/*?* something *" as a, b, c

| parse ....

| parse ....

 

And this is what I want to do

| parse "/endpoint1/*/*?* something *" as a, b, c, "endpoint1" as path

| parse "/endpoint2/*/*?* something *" as a, b, c, "endpoint2" as path

 

 

0

• 

  Olaf Stein

  • August 24, 2017 18:17

  Hi Carlos,

  The best way to do this is just parse the path:

  | parse "/*/*/*?* something *" as path, a, b, c

  Hope this helps

  Olaf

  1

  Comment actions Permalink
• 

  Carlos Andonaegui

  • August 24, 2017 18:21

  Turn out that paths are much more complex

  0

  Comment actions Permalink
• 

  Olaf Stein

  • August 24, 2017 19:47

  In what regard? We may have to use regex to extract them then...if you have some example I can take a look

  0

  Comment actions Permalink
• 

  Carlos Andonaegui

  • August 26, 2017 01:04

  I did it using if let me put the next scenario for Nginx logs
  
  sample log "POST /path/1 200"

  
  | parse "\"* /complex/*/endpoint/* *" as method, value1, value2, http_code nodrop
  | parse "\"* /this/*/that *" as method, value1, http_code nodrop
  | parse "\"* /this/*/these *" as method, value1, http_code
  | if(_raw matches "*/complex/*/endpoint/*", "complex_endpoint", "") as path
  | if(_raw matches "*/this/*/that*", "this_that", path) as path
  | if(_raw matches "*/this/*/these*", "this_these", path) as path
  | broup by path, http_code
  | order by path

  I know it may be the hard way but it works. hopefully, in the future, we can use something like:

  | parse "* /something/*/else" as method, value1, "something_else" as path

  it's an idea.

  0

  Comment actions Permalink
• 

  Olaf Stein

  • August 28, 2017 10:48

  Carlos,

  couple of things. You can create fields with hardcoded values like this:

  | "something_else" as path

  Since the value here is variable you can use the if operator, as above, or extract the values and build it dynamically. If the paths are too complex to do that the if operator is your best bet.

  Thanks

  Olaf

  0

  Comment actions Permalink

Please sign in to leave a comment.