# Simple log parse

**URL:** <https://community.dynatrace.com/t/simple-log-parse/40866>\
**Category:** DQL\
**Tags:** dql\
**Created:** [July 25, 2023, 10:44pm UTC](https://community.dynatrace.com/t/simple-log-parse/40866 "2023-07-25T22:44:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![derija](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@derija](https://community.dynatrace.com/u/derija)\
**Post date:** [July 25, 2023, 10:44pm UTC](https://community.dynatrace.com/t/simple-log-parse/40866/1 "2023-07-25T22:44:56Z")

</div>

Hello,

Some of the parsing examples leave you not sure how to proceed.

Data row in log file:

20230725 15:24:14.278 [INFO] DM.WAInputSessionRequestProcessor:7507: [2023-07-25\_15:24:14.278] Thread pool name = DM.InputProcessor creating new thread = DM.InputProcessor\_312 current thread count = 307/380/ max thread pool size = 2000

I just want the string **“current thread count = 307/380/ max thread pool size = 2000”**

I can find the log row:

fetch logs  
| filter matchesValue(dt.entity.host, “HOST-6C20F746C34E87C0”)  
| filter matchesPhrase(content, “current thread count”)  
| fieldsAdd fieldToParse = “current thread count”  
| parse fieldToParse, “ld:text EOL”

But how do I just get the string specified above?

Thank You

---

<div class="post-metadata">

**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\
**Post date:** [July 26, 2023, 6:14am UTC](https://community.dynatrace.com/t/simple-log-parse/40866/2 "2023-07-26T06:14:14Z")

</div>

Hi&nbsp;[@derija](https://community.dynatrace.com/user/51897)

Not sure if I fully understand your question. You can parse the the string with following pattern using [macros](https://www.dynatrace.com/support/help/shortlink/dpl-pattern-expression-macros)

```markup
| parse content, """$threadCount = 'current thread count' LD;
DATA $threadCount:text"""

```

and the thread numbers can be parsed with following pattern

```markup
| parse content, """DATA 'thread count = ' INT:thread1 '/' INT:thread2 LD 'thread pool size = ' INT:poolSize"""

```

and here you have the full query

```markup
| fetch logs
| filter dt.entity.host == "HOST-6C20F746C34E87C0"
| filter matchesPhrase(content, "current thread count")
| parse content, """$threadCount = 'current thread count' LD;
DATA $threadCount:text"""
| parse content, """DATA 'thread count = ' INT:thread1 '/' INT:thread2 LD 'thread pool size = ' INT:poolSize"""

```

 ![sinisa_zubic_0-1690352043862.png](https://global.discourse-cdn.com/dynatrace/original/2X/8/866d7f85ea862adc585538a9a5ce40687c6dbd2b.png)

Best,  
Sini