topic Re: Parsing a log file with DQL in DQL

Parsing a log file with DQL

Raul_CL — Fri, 27 Oct 2023 08:02:44 GMT

Hi everyone
I'm new to working with Dynatrace and new in this community.
I'm writing you because I'm trying to parse out attributes in a log with DQL (Grail), but I'm having a problem getting a clean value.
My log has (among other info) the next text:

2023-10-25 12:02:35.661320 "MT8"="1314" "OMT"="1304" "RACQ_ID"="00100"

I want to parse it creating columns with MT8, OMT and RACQ_ID, however, I'm getting the value with "="1314. I just wish to get 1314, without quotes and the equal symbol.

I was wondering if you could tell me if there is a way to do that.
I'm using:

|fetch logs
| filter matchesValue(host.name, "node1" )
| filter matchesValue(log.source, "/app01/ssk/output.log")
| sort timestamp desc
| parse content, "LD 'MT8', LD:MT 'OMT', LD:OMT 'RACQ_ID' LD:RACQ_ID"
| fields timestamp , MT8 , OMT , RACQ_ID

Re: Parsing a log file with DQL

dannemca — Thu, 26 Oct 2023 18:35:22 GMT

Try this out:

|parse content, "LDF:Text '\"MT8\"=\"', LD:MT8 '\" \"OMT\"=\"', LD:OMT '\" \"RACQ_ID\"=\"', LD:RACQ_ID '\"'"

Let us know if worked.

Re: Parsing a log file with DQL

Raul_CL — Thu, 26 Oct 2023 19:28:27 GMT

Hi Dannemca
It worked. I just changed LDF:Text by LD only and now I get just the value.
|parse content, "LD '\"MT8\"=\"', LD:MT8 '\" \"OMT\"=\"', LD:OMT '\" \"RACQ_ID\"=\"', LD:RACQ_ID '\"'"

Thank you very much