Conversion to DQL for Logs

This page covers converting log matching rules when you Upgrade Log Monitoring Classic to Log Management and Analytics from Log Monitoring Classic.

You can initially continue using log processing rules, log metrics, and log events based on the LQL syntax, however, LQL will be deprecated soon. We recommend that you convert your LQL queries to DQL queries. The transformation is automatic and simple.

Why do I need to convert?

Dynatrace doesn't support LQL-based matcher queries to analyze data in the Grail data lakehouse. While the LQL-based queries will work for a transitional period, Dynatrace will not support both types of queries indefinitely, as it would have a negative impact on ingest performance.

What happens if I don't convert?

Eventually, Dynatrace will no longer accept LQL-based matcher queries. Configurations with rules containing LQL queries will become invalid and won't be executed.

Are there any limits or special cases?

You will see the major difference when you compare:

The LQL = operator used on the content field
The DQL matchesPhrase function (see DQL matcher in logs)

In LQL, Dynatrace tokenized the content and performed a full-text search on it.

In DQL, the matchesPhrase function takes a simpler approach: it performs a contains operation case-insensitively for ASCII characters, and then it check if the preceding and succeeding characters are part of the word.

While LQL = and DQL matchesPhrase work similarly in general practice, there are differences in certain cases. For example, when there is a tabulator sign between two words and the matcher query uses a space character in that place, the query would match with LQL but will no longer match with the DQL matchesPhrase function. See the function examples for additional special cases.

[Built-in] rules

You do not have to convert the [Built-in] rules. Dynatrace will perform the conversion for you when the LQL syntax is phased out.

Convert to DQL in Log processing

If your log processing rules contain a matcher with a query based on LQL (Log Monitoring Classic) and you switched to Grail lakehouse, you must convert your LQL queries to the latest DQL syntax.

To preserve each rule's integrity and validity, you must convert each rule individually. We recommend that you also test each converted rule before saving it to make sure that the rule's result does not change.

To convert a rule

Go to Settings > Log Monitoring > Processing.

If there are rules that still need to be converted, the Log processing page will display a message that includes:
- The number of log processing rules that need to be converted
- A Convert to DQL button
  Each of your matcher rules needs to be converted separately. Go through all of your processing rules.
On the Log processing page, select Convert to DQL.
Dynatrace will find and expand the first log processing rule that requires conversion.
Select Convert to DQL to convert that rule's matcher query to DQL.

Example: Matcher rule in LQL:
```
service.name="log-monitoring-tenant"
```
After transforming to DQL:
```
matchesValue(service.name, "log-monitoring-tenant")
```
Select Test the rule and inspect the results to make sure the conversion to DQL maintained the rule's integrity.
If the results are correct, select Save changes.
To convert another rule, go to step 2.

Convert to DQL in Log metrics

To convert your LQL queries into DQL:

Go to Settings > Log Monitoring > Metrics extraction.
Find the banner message with the Convert to DQL button. The second sentence tells you how many metrics will be converted.
Select Convert to DQL.
Each of your metric queries needs to be converted separately. Go through all of your log metrics.

Example:

Metric query in LQL
```
content="http in"
```
After transforming to DQL:
```
matchesPhrase(content, "http in")
```
Select Save changes.

Convert to DQL in Log events