Introduction
Joel Mora created an outstanding series of videos that explain how to use DataSet parsers. These videos will teach users with basic regexp experience to become DataSet power users.
As a DataSet employee who is relatively familiar with the workings of parsers and regexps, I observed that these videos reinforce a number of best practices while expanding upon useful techniques for a variety of real-world logging scenarios.
The playlist of 7 videos can be accessed here
Chapters
I have provided a comprehensive list of topics by their timestamps for users who have specific questions. Furthermore, our knowledge base articles reference these video segments by timestamp when the associated topics are discussed.
Why Parse?
Advantages of parsing include:
- Better performance when searching
- Enables additional features
Use parsed fields in:
- Condition statements
- Graphs
- Alerts
- PowerQueries
- Regular expression searches
- Display in field column
The "Inspect Fields" dialog, which displays breakdown of log lines
Regex
- DataSet regex support
- Lookaround Support - not supported
Formats
- Free-text log parser tester
- Debugging parser tester
- How parsers are associated with logs
- Line formats
- The
timestampfield - How timestamp and timezone are interpreted
- Cascading format lines
- Implementing the
haltstatement
- Implementing the
Patterns and Groupers
Attributes and Rewrites
Structured Data Part 1
Applies the topics covered in the above sections
lineGroupersmessage(reserved field)- Parsing JSON
timestamp(reserved field)rewritesseverity(reserved field)- Handling JSON that references reserved field name
- Either handle it in advance with dedicated format line, or
- Use
attrBlacklist
- Extracting URL parameters
Structured Data Part 2
Applies the topics covered in the above sections
Comments
0 comments
Please sign in to leave a comment.