FR: Log Parsing rule definitions support in Quickstarts

[thezackm]

Summary

Requesting support of adding Log Parsing definitions in quickstarts.

Desired Behavior

Log Parsing Rules have Nerdgraph mutations available.

As a user, I need to have pre-built parsing rules applied to the log data I send to New Relic from common situations and use-cases that enhance the value of my logs telemetry by adding fields for better searching and faceting.

Example:

When I click to instrument and add dashboards for a quickstart with NPM data for my Cisco ASA firewalls; I expect to have pre-built parsing rules added as well so my syslog data is immediately valuable to me.

Possible Solution

New YAML standard for outlining the required fields on a parsing rule

    rule: {
      description: "example parsing rule"
      enabled: false
      grok: "sampleattribute=%{NUMBER:test:int}"
      lucene: "logtype:testLogs"
      nrql: "SELECT * FROM Log WHERE `logtype` = 'testLogs'"
    }

rules:
  - description: 
      enabled: 
      grok:
      lucene: 
      nrql: 

Note: there is an open ticket in the logs team to remove the requirement for the NRQL field here, FYI

cc: @jpvajda

[jpvajda]

@thezackm Are there particular quickstarts that would benefit from this feature? Which ones come to mind off the top of your head?

[jpvajda]

@thezackm do we have any customer references asking for this feature?

[lchapman4]

@jpvajda

We've had several requests since NR Logs was released. As a follow-up to Zack's PR here, my colleague Marcel and I would like to submit default parsing patterns for our OHIs.

In general, this would allow engineers in the field to submit parsing patterns for other data sources on behalf of customers and allow them to be shared. As it is today, when we create custom parsing for customers it stays with that customer and isn't shared with the rest of the field or other customers.

[github-actions[bot]]

Old issues will be closed after 105 days of inactivity. This issue has been quiet for 90 days and is being marked as stale. Reply here to keep this issue open.

[thezackm]

commenting to appease the stale-bot overlords

[jpvajda]

@thezackm 🤖 🤖 🙏

[github-actions[bot]]

Old issues will be closed after 105 days of inactivity. This issue has been quiet for 90 days and is being marked as stale. Reply here to keep this issue open.

[seemantk]

@lchapman4 @thezackm this just came across my radar screen. How can we proceed with making this happen?

[github-actions[bot]]

Old issues will be closed after 105 days of inactivity. This issue has been quiet for 90 days and is being marked as stale. Reply here to keep this issue open.

[github-actions[bot]]

This issue is being closed due to inactivity. Is this a mistake? Please re-open this issue or create a new one.