DQL extraction and parsing commands

• Latest Dynatrace
• Reference
• Updated on Sep 07, 2026

jsonExtract

Parses a JSON string and extracts the root-level keys of the JSON object to root-level record fields.

Syntax

jsonExtract input [, conflicts]

Parameters

Collision handling

Existing fields in the record are never removed or overwritten. If root-level fields with the same name already exist (that is, if collisions occur), the respective JSON keys can be forwarded into a dedicated field defined by the conflicts parameter.

If the JSON object contains duplicate keys, only one value is kept. There is no guarantee as to which key/value pair is selected.

Data type mapping

The data types of the extracted fields (and array elements or nested fields) correspond to the JSON data type of the respective keys:

Grail constraint

When using the jsonExtract command in DQL queries, all fields in the input stream must be known at query planning time. If this is not the case, you can insert the fields command before the jsonExtract command to specify all the fields that should be retained.

Basic examples

Example: Extract JSON fields with conflict handling

data record(timestamp = now(),
            content = """{"loggerName":"Log4JGenerator", "threadId":33, "loglevel":"ERROR"}""",
            loglevel = "WARN",
            log.source = "/var/log/messages")
| jsonExtract content, conflicts: collisions

Query result:

Example: Extract JSON fields from log records

The following example extracts JSON fields from the content field of log records fetched from Grail. Since log records don't have a fixed schema, the fields command is used to guarantee that all fields in the input stream to the jsonExtract command are known.

fetch logs
| filter startsWith(content, "{")
| fields timestamp, content
| jsonExtract content

parse

Parses a record field and puts the result(s) into one or more fields as specified in the pattern.

The parse command works in combination with the Dynatrace Pattern Language for parsing strings.

Syntax

parse expression, pattern [, preserveFieldsOnFailure] [, parsingPrerequisite]

Parameters

Basic example

Example: Parse log content

The following example parses the content field, which shows the content of a log line. The parse command adds the parsed fields to the set of fields of the record.

data record(content="117.16.75.9--[14/Mar/2016:23:34:25 +0200] GET//setup.php HTTP/1.1 404 474")
| parse content, "IPV4:ip LD HTTPDATE:time ']' LD:text"

Query result:

Example: Handle parsing failures when overwriting fields

The following example parses the content field preserving existing fields specified in the pattern if parsing fails for the record.

data record(content = "1,alice,192.168.1.1"),
     record(content = "2,,10.6.24.18", username = "bob"),
     record(content = "3,mallory,192.168.1.3")
| parse content, "( INT:sequence LD:username IPADDR:ip)(fs=',')",
    preserveFieldsOnFailure: true

Query result:

Example: Conditional parsing of log content

The following example conditionally parses the content field. The parsingPrerequisite parameter of the parse command determines which records to parse.

data record(content = "2016-03-14 23:37:07;www.example.com (192.168.0.1)"),
     record(content = "2016-03-14 23:37:06;www.example.com")
| parse content, "TIMESTAMP ';'LD ( '(' IPADDR:server ')' )",
    parsingPrerequisite: contains(content,"(")

Query result:

Practical example

Example: Apache access logs

In the following example, the parse command extracts all the relevant fields from Apache access logs.

fetch logs
| filter dt.entity.process_group == "PROCESS_GROUP-628E1D4CAD1B41B9"
| fieldsKeep content
| parse content, """(IPADDR:'http.client_ip' | [! \n]+):host
    ' ' ('-' | NSPACE:ident)
    ' ' ('-' | (DATA{1,8096}:auth >>(' [' HTTPDATE)))
    ' ' '[' HTTPDATE:event_time ']'
    ' ' (('\"' [A-Z-_]+:'http.method' ' '  LD{0,8096}:uri ' ' LD{3,10}:'http.flavor' '\"')
            | DQS:invalid_request
      )
    ' ' LONG:'http.status_code'
    ' ' (LONG:'http.response.content_length' | '-')
    (' ' DQS:referer (' ' DQS:user_agent)?)?"""
| summarize count = count(), by: { http.status_code }