CODEWITHSUNDEEP
logstash-grokdatadog
Mugen
Mugen

Reputation: 9095

Extracting exception kind and message using grok parsing from json log

On Datadog log pipelines, I want to extract an exception kind and message from a standard stack trace.

Example log entry:

{
    "Timestamp":"2025-02-13T12:51:30.2967129+00:00",
    "Level":"Error",
    "MessageTemplate":"A wrong had happened",
    "Exception":"System.Threading.Tasks.TaskCanceledException: The request was canceled due to the configured HttpClient.Timeout of 5 seconds elapsing.\n ---> System.TimeoutException: The operation was canceled.\n ---> System.Threading.Tasks.TaskCanceledException: The operation was canceled.\n ---> System.IO.IOException: Unable to read data from the transport connection: Operation canceled.\n ---> System.Net.Sockets.SocketException (125): Operation canceled\n   --- End of inner exception stack trace ---\n   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)\n   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource<System.Int32>.GetResult(Int16 token)\n   at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](CancellationToken cancellationToken)\n",
    "Properties":{
        "dd_service":"acme-server",
        "dd_version":"1622",
        "dd_env":"prod",
        "dd_trace_id":"4478286659786752651",
        "dd_span_id":"2245922714408109978",
        "SourceContext":"Acme.Server",
        "ActionId":"e6784811-5e38-4429-bb34-3af3578ed253",
        "ActionName":"Acme.LoginAsync (Acme.Server)",
        "RequestPath":"/api/login",
        "Context":"xxx",
        "MachineName":"machine-x"
    }
}

I tried to define following rule, but it doesn't match on the Datadog editor, nor does it seem to match anything at runtime.

Parsing rule:

error_rule %{data:error.kind}: %{data:error.message}(\n|\t).*

Extract from: @Exception

Any hints? All examples I could find are addressing non-json formatted logs.

Upvotes: 0

Views: 17

Answers (0)

Related Questions