Not a customer? Click the 'Start a free trial' link to begin a 30-day SaaS trial of our product and to join our community.
Existing Cisco AppDynamics customers should click the 'Sign In' button to authenticate to access the community
02-23-2024 05:42 AM
I have Log Analytics deployed through the agent machine using JOBs and I parse it through the grok expression. However, I noticed that I also receive data in the database that clearly do not match, which means that they do not have an ERROR logLevel.
Which I don't want to parse into columns, but I don't even want to have them in the database due to capacity.
grok patterns:
- "%{TIMESTAMP_ISO8601:logEventTimestamp}%{SPACE}\\[%{NUMBER:logLevelId}\\]%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}-%{SPACE}%{GREEDYDATA:msg}"
pattern.grok:
LOGLEVEL ([Ee]rr?(?:or)?|ERR?(?:OR)?)
Requered data:
Unnecessary data:
I would be interested in how to get rid of them, or where they can be used clause where or a filter?
Solved! Go to Solution.
03-07-2024 04:09 AM
This answer came to me from support:
Now Regarding "Having so many resources allocated just for extracting errors from logs does not seem like the right way to me."
None of the suggested recommendations was to fetch only ERROR data from logs, as it is clearly mentioned that this can not be done per the product design. The recommendations however were for how in this scenario when we can't control what comes to ES from your log files, can we still manage your data and space nicely so that you get the useful data and discard extra data to have not to worry about using more disk space on this host.
Regarding "Alternatively, could you recommend me how to select only errors from the log files?". This is already answered in point 1.
03-07-2024 09:57 AM
Hi @Zoltan.Gutleber,
Thanks so much for coming back and sharing the solution!
Thanks,
Ryan, Cisco AppDynamics Community Manager
Found something helpful? Click the Accept as Solution button to help others find answers faster.
Liked something? Click the Thumbs Up button.
Check out Observabiity in Action
new deep dive videos weekly in the Knowledge Base.
User | Count |
---|---|
3 | |
1 | |
1 | |
1 |
Thank you! Your submission has been received!
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form