DQL for sum of MSG content

[Vikas_g1997]

Hi Team,

We are trying to display the number of logs that contain a specific message and service name.

Example:

• Message: instantiating container sampler process decorator
• Service Name: timor-fulfilment-service

Below is a sample of the ingested content for reference:

time="2025-11-27T13:25:38Z" level=warning msg="instantiating container sampler process decorator" component=ProcessSampler error="containerd sampler: no running task found: task 58654b36c6b3525aabf06ed00a341bc3d7073cd03a9e7be5e282ed3b64b5617e not found: not found"

[27/Nov/2025:20:27:20 +0120] o.a.h.c.p.ResponseProcessCookies [providers-executor-service] WARN [Txn-53984749-ea37-4f22-9905-751f43fcbeb5 - Req-ee48a749-e368-4821-9a7f-fac6ef5e2c18] - [Referer-tyk-api-gateway,timor-fulfilment-service] - Invalid cookie header: "Set-Cookie: AWSALBCORS=shSBcB3Lcxk69XOUUXqCpTl/PQGtLa7/cMKR4A2qgYw5hmgDDYOOxLcczdSnQ6yH9wxKjfmdSYcsgKHka6fs0l9qh/jKa1apROe3yzYjw9ooMGRAgdtK8BDVDl9F; Expires=Thu, 04 Dec 2025 13:27:19 GMT; Path=/; SameSite=None". Invalid 'expires' attribute: Thu, 04 Dec 2025 13:27:19 GMT NR-LINKING|MTMyMDIxMnxBUE18QVBQTElDQVRJT058MTU4NzA4MTM4Nw|delivery-system-prod-blue-78bf55f895-q4vdj|202845d71cbf751e6a4f51784744b8cc|ca0310833f3e789a|transformer-delivery-system-prod|

Could you please help us with a query to fetch logs based on the above criteria?

Thanks & Regards,
Vikas

Ex:- Output required

[t_pawlak]

Hi @Vikas_g1997,

You can retrieve the number of logs that contain both the specific message text and the service name by filtering on the content field, which holds the raw log body for your ingestion pipeline.
Here is the DQL query that will give you the correct count:

fetch logs
| filter matchesValue(content, "*instantiating container sampler process decorator*")
  AND matchesValue(content, "*timor-fulfilment-service*")
| summarize count = count()