topic Extract specific value/pattern from log file in DQL

Extract specific value/pattern from log file

Agoyals — Wed, 11 Jun 2025 11:04:11 GMT

Hi ,

I am new to Dynatrace and looking to explore logs. Looking for help to extract specific value from logs.

Query
fetch logs
| filter dt.host_group.id == "XXXX" AND log.file.path == "XXXXX"

Example log content

[2025-06-11T05:15:35.487-0400][1596955825ms] GC(175) Pause Young (Normal) (G1 Evacuation Pause) 334M->40M(512M) 5.847ms

[2025-06-11T05:15:35.492-0400][1596955830ms] GC(175) Pause Young (Normal) (G1 Evacuation Pause) 362M->55M(512M) 4.827ms

[2025-06-11T04:14:04.275-0400][473664263ms] GC(58) Pause Young (Normal) (G1 Evacuation Pause)

Looking to extract the ms value at the end of event. I tried to use parse command but not working.

Re: Extract specific value/pattern from log file

jmarbaix — Wed, 11 Jun 2025 12:17:59 GMT

Hi Agoyals,

You can do something like this:

fetch logs
| filter dt.host_group.id == "XXXX" AND log.file.path == "XXXXX"
| parse content, """
DATA
'(512M)' // Literal string just before the ms value
SPACE // Space character before the desired value
(DIGIT '.' DIGIT):value // The value column will contain the desired number, if it's always in the form X.XXX
'ms' // To end the parsing

If you want to plot the values, or handle them as a number, you can use the following command:
| fieldsAdd value = toDouble(value)

Hope this helps.

Re: Extract specific value/pattern from log file

g_kat — Wed, 11 Jun 2025 12:52:53 GMT

Hi,

Adding to @jmarbaix's answer, you could also use this parse in case you don't have that 512M as static:

parse content, "LD'->' LD SPACE (DIGIT'.'DIGIT):value 'ms'"

Note: if you convert it to double it will round the value to 2 decimal points. In which case, you can straight up transfomr it to double by doing: DOUBLE:value in the parse.

Re: Extract specific value/pattern from log file

jmarbaix — Wed, 11 Jun 2025 12:55:18 GMT

Good one!