Not be able to assign value dynamically for the match_array function . about openobserve HOT 4 CLOSED

For your clarification, We are using openobserve-v0.5.1-linux-amd64-musl.tar. Please help !

from openobserve.

@RVaidhy please upgrade to v0.5.2 , to use functions with more lines.

Also please note , when you ingest data to openobserve all fields names are in small case , for eg :

{"_timestamp":1694143686586724,"agent":"Java","http_status":"220","id":"32qqjhasd34q34n","operation":"USER CALL","request_method":"GET","request_url":"/api/cargo-local/GYQV_MATANO_SAMPLE_REPO/sample.json","request_user_agent":"jfrog-mission-control/erere","timestamp":"2023-08-23T10:49:59.409TZ","username":"anonymous"}

Hence your function needs to be modified to use:
.req_url_split,error1=split(.request_url, "/")

instead of : .req_url_split,error1=split(.request_URL, "/") to

from openobserve.

tested with above mentioned data & function, working fine with fixes

from openobserve.

Hi Oasisk,

Even after applying the fixes that you have mentioned we had that same issue.

To get rid of that we have used the following method. Basically match_array expects regex formatted data. So from a full string if you extract a sub-string and wanted to validate that specific value against array or something we may need to follow the below options.

Say you have a predefined list of values and you wnated to compare the extracted value with that. This is our scenario.
request_url_array = ["sample","values","tobe","inserted","here"]

Now, from logs we have got one field like below.
.extrated_substring = string!(.url)

Convert that to regex as below,
.urlInfoRegex = to_regex(.extrated_substring)?? r''

Now pass this to match_array.
.isUrlExist = match_array(.request_url_array,.urlInfoRegex)

So in our case, if we want to validate a specific value against an array of values we shall refer the above method. It may be useful to someone. Thats why sharing here for ref. Thanks!

from openobserve.