0

Given I have a log like the following, is it possible to retrieve the count of occurences in the same log?

my.failures:"[{\"id\": \"one\", \"file\": \"myfile1\"}, 
{\"id\": \"one\", \"file\": \"myfile2\"}, 
{\"id\": \"two\", \"file\": \"myfile3\"}]"

I would like to get a metric for the number of times the word one show up, to be exact "id": "one" show up, in this case 2 times

so that when I have something like this

my.failures:"[{\"id\": \"one\", \"file\": \"myfile1\"}, 
{\"id\": \"one\", \"file\": \"myfile2\"}, 
{\"id\": \"two\", \"file\": \"myfile3\"}]"
my.failures:"[{\"id\": \"one\", \"file\": \"myfile1\"}]"

The count should be 3 times.

But I can only match the word per log with the following query

FROM Log Select COUNT(*) WHERE my.failures LIKE '%one%'

is it possible? if so how?

Harts
  • 4,023
  • 9
  • 54
  • 93

1 Answers1

0

NRQL doesnt have deep enough string and array parsing capabilities.

The typical work arounds I’ve seen to situations like that are to a) If you can, break up the array and arrange the data in a way that makes it possible to do what you want before sending it.

b) Otherwise use some kind of external scripting to parse the data and then write the metric back in. Some people do these within New Relics Synthetics scripts, others just run it from a cloud function or even just a cronjob with a shell script on a server that pulls down the data and manipulates it and writes the result back into New Relic as a custom metric or event.

Daniel New Relic
  • 11
  • 2