Set default values in parsing
What I want to do is very simple Im doing this.
fyi Iim not using regex
| parse "/endpoint/*/*?* something *" as a, b, c
| parse ....
| parse ....
And this is what I want to do
| parse "/endpoint1/*/*?* something *" as a, b, c, "endpoint1" as path
| parse "/endpoint2/*/*?* something *" as a, b, c, "endpoint2" as path
-
I did it using if let me put the next scenario for Nginx logs
sample log "POST /path/1 200"
| parse "\"* /complex/*/endpoint/* *" as method, value1, value2, http_code nodrop
| parse "\"* /this/*/that *" as method, value1, http_code nodrop
| parse "\"* /this/*/these *" as method, value1, http_code
| if(_raw matches "*/complex/*/endpoint/*", "complex_endpoint", "") as path
| if(_raw matches "*/this/*/that*", "this_that", path) as path
| if(_raw matches "*/this/*/these*", "this_these", path) as path
| broup by path, http_code
| order by pathI know it may be the hard way but it works. hopefully, in the future, we can use something like:
| parse "* /something/*/else" as method, value1, "something_else" as path
it's an idea.
-
Carlos,
couple of things. You can create fields with hardcoded values like this:
| "something_else" as path
Since the value here is variable you can use the if operator, as above, or extract the values and build it dynamically. If the paths are too complex to do that the if operator is your best bet.
Thanks
Olaf
Please sign in to leave a comment.
Comments
5 comments