topic Need Help with String Extraction in DPL in DQL

Need Help with String Extraction in DPL

Akhil-Jayendran — Tue, 17 Jun 2025 22:44:15 GMT

Hello Team,

I would like to extract only values matching the pattern *appdevgw-*** from below sample logs data and assign them to a new field named HostName with capital letters, for example: HostName=DAPPDEVGW-001. Is that possible using DPL ?

DATA record(host.name="dappdevgw-001.phx.ad.company.com", message= "this is a test message 1"),

record(host.name="pappdevgw-006.phx.ad.company.com", message= "this is a test message 2"),

record(host.name="bappdevgw-007.phx.ad.company.com", message= "this is a test message 3")

Br,

Re: Need Help with String Extraction in DPL

Akhil-Jayendran — Wed, 18 Jun 2025 01:36:21 GMT

I think I found it in a different way. without DPL.

DATA record(host.name="dappdevgw-001.phx.ad.company.com", message= "this is a test message 1"),
record(host.name="pappdevgw-006.phx.ad.company.com", message= "this is a test message 2"),
record(host.name="bappdevgw-007.phx.ad.company.com", message= "this is a test message 3")
| fieldsAdd HostName = splitString(host.name, ".")
| fieldsAdd HostName =arrayFirst(HostName)
| fieldsAdd HostName= upper(HostName)

But I’m curious — is this possible with DPL?

Re: Need Help with String Extraction in DPL

jmarbaix — Wed, 18 Jun 2025 08:43:31 GMT

DPL is only for extraction, not for adapting the string itself. You need to compare it to regular expressions. This means that if you want to do more than just matching/searching and extracting a string, you will need a DQL statement.

A solution with DPL could be:

DATA record(host.name="dappdevgw-001.phx.ad.company.com", message= "this is a test message 1"),
record(host.name="pappdevgw-006.phx.ad.company.com", message= "this is a test message 2"),
record(host.name="bappdevgw-007.phx.ad.company.com", message= "this is a test message 3")
| parse `host.name`, """DATA?
(DATA{1}
'appdevgw-'
DATA{3}):HostName
DATA"""
| fieldsAdd HostName = upper(HostName)