parse

The parse command extracts information from a text field using a regular expression and adds the extracted information to the search results. It uses Java regex patterns. For more information, see the Java regular expression documentation.

The rex and parse commands compared

The rex and parse commands both extract information from text fields using Java regular expressions with named capture groups. To compare the capabilities of the rex and parse commands, see the rex command documentation.

Syntax

The parse command has the following syntax:

parse <field> <pattern>

Parameters

The parse command supports the following parameters.

Regular expression

The regular expression pattern is used to match the whole text field of each document based on the Java regular expression syntax. Each named capture group in the expression becomes a new STRING field.

Example 1: Extracting error details from log messages

The following query extracts the error summary and detail from error log messages. This is useful for categorizing errors during incident triage:

source=otellogs
| where severityText = 'ERROR'
| parse body '(?<errmsg>[^:]+): (?<detail>.+)'
| fields errmsg, detail
| head 3

The query returns the following results:

Example 2: Extracting IP addresses from log messages

The following query extracts IP addresses from log messages for a specific service:

source=otellogs
| where `resource.attributes.service.name` = 'frontend'
| parse body '.+from (?<sourceip>[0-9.]+)'
| fields body, sourceip
| head 3

The query returns the following results:

Limitations

The parse command has the following limitations:

• Fields created by the parse command cannot be parsed again. For example, the following command does not function as intended:

    source=otellogs | parse body '(?<errmsg>[^:]+): (?<detail>.+)' | parse detail '\\w+ (?<word>\\w+)'
  

• Fields created by the parse command cannot be overridden by other commands. For example, in the following query, the where clause does not match any documents because errmsg cannot be overridden:

    source=otellogs | parse body '(?<errmsg>[^:]+): (?<detail>.+)' | eval errmsg='1' | where errmsg='1'
  

• The source text field used by the parse command cannot be overridden. For example, in the following query, the errmsg field is not parsed correctly because body is overridden:

    source=otellogs | parse body '(?<errmsg>[^:]+): (?<detail>.+)' | eval body='1'
  

• Fields created by the parse command cannot be filtered or sorted after they are used in the stats command. For example, in the following query, the where clause does not function as intended:

    source=otellogs | parse body '(?<errmsg>[^:]+): (?<detail>.+)' | stats count() by errmsg | where errmsg='Payment failed'