Parse logs to extract field by combined regex

[ArtemR]

Hi, Community!

Could you please help with field extraction?

I have entry like below and need to extract MDCID=D8227-6494143177361398674 to the separate field

data record(content = "-2025-05-01 23:02:58.960 INFO MDCID=D8227-6494143177361398674 [,] 1 --- [platformRequestMessageListenerContainer-9] AccrualLog: ABC Return: <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <pfx6:ABCPublisher ")

General rules are:

1. Starts with exact MDCID
2. Contains uppercase, numbers, = (equal sign), - (dash sign)
3. Has minimal length of 12 (e.g. MDCID=A12-23)
4. Ends before closest space after

But I struggling with creating parse expression, as not sure how to combine several patterns to single column in output. E.g.

data record(content = "-2025-05-01 23:02:58.960 INFO MDCID=D8227-6494143177361398674 [,] 1 --- [platformRequestMessageListenerContainer-9] AccrualLog: ABC Return: <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <pfx6:ABCPublisher ") 
| parse content, "LD ['MDICD='{*}0-9{*}a-z]{12,100}:id LD"

gives me 6494143177361398674 so 'MDICD=' is ignored. Could you please help to create correct expression? Seems like I'm using `{*}` in a wrong way (just saw it in some example but without explanation)

Also appreciate if you can share detailed regular expression for Dynatrace guide, as links like this https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-pattern-language do not cover cases with combined expressions (like "MDCID" and "=" and "A-Z" ...)

[sinisa_zubic]

Hi @ArtemR 

You have to use macros, please have a look at the example

data record(content = "-2025-05-01 23:02:58.960 INFO MDCID=D8227-6494143177361398674 [,] 1 --- [platformRequestMessageListenerContainer-9] AccrualLog: ABC Return: <?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <pfx6:ABCPublisher ")
| parse content, """$id = 'MDCID=' [A-Z0-9=-]{6,};
LD $id:id"""

Best,
Sini

[ArtemR]

Hi @sinisa_zubic 

Great, I believe macros is what I need. It's working, thank you.