|
Group: Forum Members
Posts: 9,
Visits: 16
|
Hello,
I'm currently evaluating your product to determine if it will work for parsing our logs.
We have json logs that certain key/value pairs always exist and some that are only there certain times. The order of the key/value pairs could be different as well.
I'm noticing that sometimes the logs get parsed incorrectly and the values show up in the wrong column. Is this a issue in your product or the way I've setup my json parser?
Parser setup
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
{
"Timestamp": "%d{yyyy-MM-ddT%H:mm:ss.fffffffzzzz}",
"Level": "%p",
"RenderedMessage": "%m",
"Properties": {
"EventId": {
"Id": "%S{Event Id}",
"Name": "%S{Event Name}" },
"ProcessId": "%s{Process Id}",
"ThreadId": "%t",
"SourceContext":"%S{Source Context}"
}
}
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Log that parses correctly
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
{
"Timestamp": "2019-07-19T09:48:52.2880729-07:00",
"Level": "Debug",
"MessageTemplate": "{task} processing completed in {duration}.",
"RenderedMessage": "\"AgentHeartbeatTask\" processing completed in 00:00:00.3968037.",
"Properties": {
"task": "AgentHeartbeatTask",
"duration": "00:00:00.3968037",
"EventId": {
"Id": 22,
"Name": "Background task ended"
},
"SourceContext": "Tableau.PowerTools.Server.Common, Version=2019.3.0.0, Culture=neutral, PublicKeyToken=null",
"Scope": [
"ImportunateTaskRunner starting task: RunAgentHeartbeatAsync"
],
"ProcessId": 476,
"ThreadId": 11,
"PTTaskDesc": "AgentHeartbeatTask",
"PTCorrelationId": "a01f0ca3-5581-4b4c-9a5d-3f32490ff7ae"
}
}
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Logs that parse incorrectly. The string "SourceContext": "Tableau.PowerTools.Server.Common, Version=2019.3.0.0, Culture=neutral, PublicKeyToken=null" ends up in the “Event ID” column when it should be in the “SourceContext” column.
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
{
"Timestamp": "2019-07-19T09:48:52.2940717-07:00",
"Level": "Debug",
"MessageTemplate": "{task} scheduled to run again in {duration} ms.",
"RenderedMessage": "\"AgentHeartbeatTask\" scheduled to run again in 300000 ms.",
"Properties": {
"task": "AgentHeartbeatTask",
"duration": 300000,
"SourceContext": "Tableau.PowerTools.Server.Common, Version=2019.3.0.0, Culture=neutral, PublicKeyToken=null",
"Scope": [
"ImportunateTaskRunner starting task: RunAgentHeartbeatAsync"
],
"ProcessId": 476,
"ThreadId": 14
}
}
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Thank you
|