EDXExtractPatterns

Learn about the EDXExtractPatterns Edge Delta OTTL extension function.

  less than a minute  

Minimum Agent Version: v1.22.0

EDXExtractPatterns enhances the standard OTTL ExtractPatterns converter function. While the default OTTL function requires a hardcoded regex pattern, this Edge Delta extension enables you to use a field reference for the pattern parameter, allowing dynamic pattern matching based on runtime data.

Syntax

EDXExtractPatterns(input, "pattern")
  • input: The source string, such as the body of a log, from which patterns are to be extracted.
  • pattern: A Golang regex pattern or field reference containing a regex pattern, used to match and extract specific parts of the input string. Named patterns can be used to provide field names.

Input:

{
  "_type": "log",
  "timestamp": 1735810699536,
  "body": "session_id=abc123 event_type=login event_status=success debug_info=verbose temp_file=report_tmp.log temp_data=sensitiveData",
  "resource": {...},
  "attributes": {
    "decoded_body": "session_id=abc123 event_type=login event_status=success debug_info=verbose temp_file=report_tmp.log temp_data=sensitiveData",
    "pattern": "session_id=(?P<session_id>\\w+)"
  }
}

Notice how the pattern in the pattern attribute has been escaped. See Regex in OTTL.

Example:

set(attributes["id"], EDXExtractPatterns(attributes["decoded_body"], attributes["pattern"]))

Output:

{
  "_type": "log",
  "timestamp": 1735810732304,
  "body": "session_id=abc123 event_type=login event_status=success debug_info=verbose temp_file=report_tmp.log temp_data=sensitiveData",
  "resource": {...},
  "attributes": {
    "decoded_body": "session_id=abc123 event_type=login event_status=success debug_info=verbose temp_file=report_tmp.log temp_data=sensitiveData",
    "id": {
      "session_id": "abc123"
    },
    "pattern": "session_id=(?P<session_id>\\w+)"
  }
}

The pattern in the pattern attribute was used to extract the session_id’s value from the decoded body.