Search code examples
sumologic

How do I add a custom filter to a log search?

How do I create and add a custom placeholder/filter to a log search in sumologic?

In this example, how would I replace dev- with an ${env} placeholder that I can use as a filter in the dashboard I am creating.

_source="syslog-collector" "dev-my-app" 
| parse "INFO : *" as jsonobject
| json field=jsonobject "load-time" as load_time
| timeslice 30m | pct(load_time, 99.9) as ms group by _timeslice
Solution

  • I used regex to parse an env variable which I then filtered on in my dashboard.

    | parse regex "(?<env>(?<=.{20}).+?(?=-my-app))"