Simple log parse

[derija]

Hello,

Some of the parsing examples leave you not sure how to proceed.

Data row in log file:

20230725 15:24:14.278 [INFO] DM.WAInputSessionRequestProcessor:7507: [2023-07-25_15:24:14.278] Thread pool name = DM.InputProcessor creating new thread = DM.InputProcessor_312 current thread count = 307/380/ max thread pool size = 2000

I just want the string "current thread count = 307/380/ max thread pool size = 2000"

I can find the log row:

fetch logs
| filter matchesValue(dt.entity.host, "HOST-6C20F746C34E87C0")
| filter matchesPhrase(content, "current thread count")
| fieldsAdd fieldToParse = "current thread count"
| parse fieldToParse, "ld:text EOL"

But how do I just get the string specified above?

Thank You

[sinisa_zubic · Accepted solution]

Hi @derija 

Not sure if I fully understand your question. You can parse the the string with following pattern using macros

| parse content, """$threadCount = 'current thread count' LD;
DATA $threadCount:text"""

 and the thread numbers can be parsed with following pattern

| parse content, """DATA 'thread count = ' INT:thread1 '/' INT:thread2 LD 'thread pool size = ' INT:poolSize"""

and here you have the full query

| fetch logs
| filter dt.entity.host == "HOST-6C20F746C34E87C0"
| filter matchesPhrase(content, "current thread count")
| parse content, """$threadCount = 'current thread count' LD;
DATA $threadCount:text"""
| parse content, """DATA 'thread count = ' INT:thread1 '/' INT:thread2 LD 'thread pool size = ' INT:poolSize"""

Best,
Sini