CODEWITHSUNDEEP
datadog
Matthew
Matthew

Reputation: 587

Datadog log remapper with change of value

I want to parse a log :

I1117 15:32:01.453645       1 secretproviderclasspodstatus_controller.go:222] "reconcile started" spcps="omy/dskjhf-kfkhdsfj-sdfjhdf-65c7989777-ktl6f-prd-hjgdsfj-secrets"

The first letter indicate the status :

It's not that hard to parse this log

{
   log_status : "I"
   ...
}

I can use the status remapper to indicate that log_status has to be used has status field. But of course I, W or E have to be understood by datadog as Info, Warn or Error, how can I make datadog understand it ?

Upvotes: 0

Views: 2483

Answers (1)

draav
draav

Reputation: 1943

Add a category processor to your pipeline after the grok parser.

enter image description here https://docs.datadoghq.com/logs/log_configuration/processors/?tab=ui#category-processor

Upvotes: 2

Related Questions