Parse Unstructured Log Content While Skipping Newlines Using DQL

mpundang — Thu, 18 Dec 2025 10:29:56 GMT

Hi everyone, I have this log format in a Managed Cluster, with Log Classic, no Grail:

"content": "last access : Wed May 22 11:32:42 ART 2025\\nmax inactive interval : 1800\\nuser name : anonymous\\nvalid session : true\\nnew session : false\\noverflowed : false\\n _refCount=1\\n } \\n _httpSessionContext=com.ibm.ws.session.http.HttpSessionContextImpl@115c1a4a\\n } \\n)\\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,936 DEBUG script.dao.GeneralDAOImpl findRow(sp_FN_Comprobantes_FNC,{54672,1,50150346002250506,39,})\\nULL1lryN-ZidhtxVbFg09WN 28/05/25 11:32:50,936 DEBUG sam.service.SamSPService <<<< TM_FEMP_DB2. - RESULTADOS: cursor -> 1 items retornados, P_COD_CLASEORD = TXO, P_COD_CLIECASH = 0026008500002886, p_sqlcode_out = null, P_COD_IDORDEN = 5751BOJN, \\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,936 INFO script.dao.GeneralDAOImpl \\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,938 INFO script.dao.GeneralDAOImpl exec sp_FN_Comprobantes_FNC 54672, null, '50150346002250506', '39', null, null, null\\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,938 INFO script.dao.GeneralDAOImpl ",

I need to get the keyvalue string: c5uZNCXLKmuKjacR5_NNqxK (23 letters).

The keyvalue appears on multiple lines in the log, and there are even other keys with the same string length that I need to capture. It's always a 23-character string.

I can check after /n (newline) begins with the keyvalue but I cannot get the value with this filter:

PARSE(content, "LD '\n' DATA [a-zA-Z0-9_-]{23}:test")

Does anybody knows what is the correct filter to get the keyvalue? and is it possible to get multiple keyvalues from this content log?

Regards!

Re: How to PARSE an unstructured log content skipping \n (newline)

DanielS — Tue, 15 Jul 2025 23:06:53 GMT

Hello @mpundang a tought one.

n\K[a-zA-Z0-9_-]{23}

or another option, less elegant

[^\n]+([a-zA-Z0-9_-]{23})

topic Parse Unstructured Log Content While Skipping Newlines Using DQL in DQL

Parse Unstructured Log Content While Skipping Newlines Using DQL

Re: How to PARSE an unstructured log content skipping \n (newline)