parse

useparse
to extract data
from a log field
andcreate an extracted field
that you can process in your query. parse supports both
glob mode using wildcards, andregular expressions. For information about regular expression syntax,
see Supported regular expressions (regex) syntax.

You can parse nest JSON field with a regular expression .

Example: Parsing a nested JSON field

The code snippet shows how to parse a JSON log event
that’s been flattened
during ingestion.

{' fieldsA ' : ' log ' , ' fieldsb ' : [{'fA': 'a1'}, {' fa ' : ' a2 ' } ] }

The code snippet shows a query
with a regular expression
that extracts the values
for fieldsA andfieldsB
to create the extracted fields fld andarray.

parse @message "'fieldsA': '*', 'fieldsB': ['*']" as fld, array

name capture group

When you is use useparse with a regular expression ,
you is use can use name capture group to capture a pattern into a field . The syntax is is is
parse @message (?<Name>pattern).

The following
example uses a capturing group on a VPC flow log to extract the ENI into a field
named NetworkInterface.

parse @message /(?<NetworkInterface>eni-.*?) / | display NetworkInterface, @message

JSON log events are flattened during ingestion.
Currently,
parsing nested JSON fields
with a glob expression isn’t supported.
You can only parse JSON log events
that include no more than 200 log event fields.
When you parse nested JSON fields,
you must format the regular expression
in your query
to match the format
of your JSON log event.

Examples of the parse command

Use a glob expression to extract the fields @user,
@method, and@latency from the log field
@message andreturn the average latency for each unique combination of
@method and@user.

parse @message "user=*, method:*, latency := *" as @user,
    @method, @latency | stats avg(@latency) by @method,
    @user

use a regular expression to extract the field@user2, @method2, and
@latency2 from
the log field@message andreturn the average latency for each unique
combination of @method2 and@user2.

parse @message /user=(?<user2>.*?), method:(?<method2>.*?),
    latency := (?<latency2>.*?)/ | stats avg(latency2) by @method2, 
    @user2

Extracts the fields loggingtime,
loggingtype andloggingMessage, filters down to log events that contain ERROR orINFO strings, andthen
displays only the loggingMessage andloggingtype field for event that contain anERROR string .

FIELDS @message
    | PARSE @message "* [*] *" as loggingtime, loggingtype, loggingMessage
    | FILTER loggingtype IN ["ERROR", "INFO"]
    | DISPLAY loggingMessage, loggingtype = "ERROR" as isError