#1131 - OCI Log Explorer for surfacing Faulted Flows

Introduction

Here is a simple way to identify successful/errored flows from the OIC Activity Stream Logs -

Check out the log fields in the activity stream - here I'm viewing them in Log Analytics -

This field can have the values -

• ProcessCompleted
• ProcessCompletedWithFaults

instanceCompletionState is not directly surfaced in the OIC Activity Stream in Log Explorer.

However, we can remedy this by creating a new field in Log Analytics - 

  

This new field, which I call Instance Completion State,  will be filled with the instanceCompletionState value from the log file.

Now that we've defined the field, let's define the extraction rule to get the required value from the log - 

Here I need to customize the Source - OIC Integration Activity Stream Logs. I need to add an extended field so I click on Extended Fields - 

Here is the extraction expression I use - 

\"instanceCompletionState\"\s*:\s*\"{Instance Completion State:[^\"]+}\"

Note instanceCompletionState is the name of the field in the log and Instance Completion State is the field I just created.

I test this - 

Now this field is available for usage in Log Explorer - 

Here is the query I use - 

'Log Source' = 'OCI Integration Activity Stream Logs' | where 'Instance Completion State' != null | fields 'Instance Completion State', Entity, 'Entity Type', 'Host Name (Server)', 'Problem Priority', Label, 'Log Source' | fields Integration | fields Instance

Here is another view - 

The query here is - 

'Log Source' = 'OCI Integration Activity Stream Logs' | where 'Instance Completion State' != null | fields 'Instance Completion State', Entity, 'Entity Type', 'Host Name (Server)', 'Problem Priority', Label, 'Log Source' | fields Integration | fields Instance | stats count as integrationFlows by 'Instance Completion State'