topic Re: Simple log parse in DQL

Simple log parse

derija — Mon, 14 Aug 2023 08:48:38 GMT

Hello,

Some of the parsing examples leave you not sure how to proceed.

Data row in log file:

20230725 15:24:14.278 [INFO] DM.WAInputSessionRequestProcessor:7507: [2023-07-25_15:24:14.278] Thread pool name = DM.InputProcessor creating new thread = DM.InputProcessor_312 current thread count = 307/380/ max thread pool size = 2000

I just want the string "current thread count = 307/380/ max thread pool size = 2000"

I can find the log row:

fetch logs
| filter matchesValue(dt.entity.host, "HOST-6C20F746C34E87C0")
| filter matchesPhrase(content, "current thread count")
| fieldsAdd fieldToParse = "current thread count"
| parse fieldToParse, "ld:text EOL"

But how do I just get the string specified above?

Thank You

Re: Simple log parse

sinisa_zubic — Wed, 26 Jul 2023 06:14:14 GMT

Hi @derija

Not sure if I fully understand your question. You can parse the the string with following pattern using macros

| parse content, """$threadCount = 'current thread count' LD; DATA $threadCount:text"""

and the thread numbers can be parsed with following pattern

| parse content, """DATA 'thread count = ' INT:thread1 '/' INT:thread2 LD 'thread pool size = ' INT:poolSize"""

and here you have the full query

| fetch logs | filter dt.entity.host == "HOST-6C20F746C34E87C0" | filter matchesPhrase(content, "current thread count") | parse content, """$threadCount = 'current thread count' LD; DATA $threadCount:text""" | parse content, """DATA 'thread count = ' INT:thread1 '/' INT:thread2 LD 'thread pool size = ' INT:poolSize"""

Best,
Sini