Parse logs to extract field by combined regex

ArtemR — Mon, 05 May 2025 07:32:09 GMT

Hi, Community!

Could you please help with field extraction?

I have entry like below and need to extract MDCID=D8227-6494143177361398674 to the separate field

data record(content = "-2025-05-01 23:02:58.960 INFO MDCID=D8227-6494143177361398674 [,] 1 --- [platformRequestMessageListenerContainer-9] AccrualLog: ABC Return: <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <pfx6:ABCPublisher ")

General rules are:

Starts with exact MDCID
Contains uppercase, numbers, = (equal sign), - (dash sign)
Has minimal length of 12 (e.g. MDCID=A12-23)
Ends before closest space after

But I struggling with creating parse expression, as not sure how to combine several patterns to single column in output. E.g.

data record(content = "-2025-05-01 23:02:58.960 INFO MDCID=D8227-6494143177361398674 [,] 1 --- [platformRequestMessageListenerContainer-9] AccrualLog: ABC Return: <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <pfx6:ABCPublisher ") | parse content, "LD ['MDICD='{*}0-9{*}a-z]{12,100}:id LD"

gives me 6494143177361398674 so 'MDICD=' is ignored. Could you please help to create correct expression? Seems like I'm using `{*}` in a wrong way (just saw it in some example but without explanation)

Also appreciate if you can share detailed regular expression for Dynatrace guide, as links like this https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-pattern-language do not cover cases with combined expressions (like "MDCID" and "=" and "A-Z" ...)

Re: Parse logs to extract field by combined regex

sinisa_zubic — Fri, 02 May 2025 10:06:56 GMT

Hi @ArtemR

You have to use macros, please have a look at the example

Best,
Sini

Re: Parse logs to extract field by combined regex

ArtemR — Fri, 02 May 2025 13:03:31 GMT

Hi @sinisa_zubic

Great, I believe macros is what I need. It's working, thank you.

topic Parse logs to extract field by combined regex in DQL

Parse logs to extract field by combined regex

Re: Parse logs to extract field by combined regex

Re: Parse logs to extract field by combined regex