cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Parsing a log file with DQL

Raul_CL
Observer

Hi everyone
I'm new to working with Dynatrace and new in this community.
I'm writing you because I'm trying to parse out attributes in a log with DQL (Grail), but I'm having a problem getting a clean value.
My log has (among other info) the next text:

2023-10-25 12:02:35.661320 "MT8"="1314" "OMT"="1304" "RACQ_ID"="00100"

I want to parse it creating columns with MT8, OMT and RACQ_ID, however, I'm getting the value with "="1314. I just wish to get 1314, without quotes and the equal symbol.

I was wondering if you could tell me if there is a way to do that.
I'm using:

|fetch logs
| filter matchesValue(host.name, "node1" )
| filter matchesValue(log.source, "/app01/ssk/output.log")
| sort timestamp desc
| parse content, "LD 'MT8', LD:MT 'OMT', LD:OMT 'RACQ_ID' LD:RACQ_ID"
| fields timestamp , MT8 , OMT , RACQ_ID

2 REPLIES 2

dannemca
DynaMight Guru
DynaMight Guru

Try this out:

|parse content, "LDF:Text '\"MT8\"=\"', LD:MT8 '\" \"OMT\"=\"', LD:OMT '\" \"RACQ_ID\"=\"', LD:RACQ_ID '\"'"

Let us know if worked.

Site Reliability Engineer @ Kyndryl

Hi Dannemca
It worked. I just changed LDF:Text by LD only and now I get just the value.
|parse content, "LD '\"MT8\"=\"', LD:MT8 '\" \"OMT\"=\"', LD:OMT '\" \"RACQ_ID\"=\"', LD:RACQ_ID '\"'"

Thank you very much

Featured Posts