hey hey me again slightly smiling face Once again with logs

Question

hey hey me again slightly smiling face Once again with logs and regex slightly smiling face thread

Hannes Benson · Answer

I have a log entry that looks like this ``` 1622 lt 190 gt 1 2023 08 11T05 46 08 075562+00 00 d 7c9c4867 7cdb 4a9a b4b8 cb877ed3084c app web 1 severity text INFO time 2023 08 11T05 46 08 075+00 00 message 9e330e7e 0e64 432e a141 51d61aa1e667 Parameters operationName = u003e GetListOptions variables = u003e page = u003e1 perPage = u003e50 filter = u003e term = u003e usageModes = u003e query = u003e query GetListOptions $page Int $perPage Int $filter ListFiltering n lists page $page perPage $perPage filter $filter n entries n ListOption n typename n n typename n n n nfragment ListOption on List n id n name n usageMode n creator n firstName n lastName n email n typename n n project n title n typename n n typename n graphql = u003e operationName = u003e GetListOptions variables = u003e page = u003e1 perPage = u003e50 filter = u003e term = u003e usageModes = u003e query = u003e query GetListOptions $page Int $perPage Int $filter ListFiltering n lists page $page perPage $perPage filter $filter n entries n ListOption n typename n n typename n n n nfragment ListOption on List n id n name n usageMode n creator n firstName n lastName n email n typename n n project n title n typename n n typename n operation GraphqlController execute span id 7b9a038f77454b7a trace id 60c75f5a12c3c9aba3c066473ed69800 ```

Hannes Benson · Answer

I d like to regex out the json

Hannes Benson · Answer

before parsing the json

Hannes Benson · Answer

I have the following processor set up

Hannes Benson · Answer

``` operators type regex parser regex P lt body gt parse from body if body matches ^ $ type json parser parse to attributes if body matches ^ $ type severity parser if severity text in attributes parse from attributes severity text output remove severity text type remove id remove severity text if severity text in attributes field attributes severity text```

Hannes Benson · Answer

``` logstransform heroku parser operators type regex parser regex P lt body gt parse from body parse to attributes if body matches $ type json parser parse from attributes body parse to attributes if body matches $ type remove id remove parsed string if body in attributes field attributes body type severity parser if severity text in attributes parse from attributes severity text output remove severity text type remove id remove severity text if severity text in attributes field attributes severity text``` has resolved the issues but now I m not getting `trace id` amp `span id` confused

Hannes Benson · Answer

Managed to fix it slightly smiling face

Hannes Benson · Answer

``` logstransform heroku parser operators type regex parser regex P lt body gt parse from body parse to attributes if body matches $ type json parser parse from attributes body parse to attributes if body matches $ type severity parser if severity text in attributes parse from attributes severity text output remove severity text type remove id remove severity text if severity text in attributes field attributes severity text type trace parser if trace id in attributes or span id in attributes trace id parse from attributes trace id span id parse from attributes span id output remove trace id id remove trace id type remove if trace id in attributes field attributes trace id output remove span id id remove span id type remove if span id in attributes field attributes span id type remove id remove parsed string if body in attributes field attributes body``` For future reference to anyone possibly trying to do the same thing

nitya-signoz · Answer

Great let me know if you need more help If this is a generic heroku parser that you have created would love to have a blog from you < Ashu> do reach out if Hannes is interested

Ashu · Answer

Thanks < nitya signoz> Will reach out to < Hannes Benson> for documenting this