String functions allow you to create expressions that manipulate text strings in a variety of ways.
All string matching functions are case-sensitive per default. If otherwise required, the caseSensitive parameter provides the ability to change the behavior.
...| fieldsAdd str_found = contains(content, "FlushCommand", caseSensitive:false)
Concatenates the expressions into a single string.
concat(expression, … [, delimiter: ])
The data type of the returned value is string.
data record(a = "DQL", b = "is", c = "awesome!")| fieldsAdd concat(a, b, c, delimiter: " ")
Query result:
Searches the string expression for a substring. Returns true if the substring was found, false otherwise.
contains(expression, substring [, caseSensitive])
The data type of the returned value is boolean.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd contains(content, "DQL"),contains(content, "dql", caseSensitive: false),contains(content, "Query")
Query result:
Returns a URL-decoded string.
decodeUrl(expression)
The data type of the returned value is string.
data record(content = "https%3A%2F%2Fwww.dynatrace.com%2Fplatform%2Fgrail"),record(content = "https://www.dynatrace.com/platform/grail")| fieldsAdd decodeUrl(content)
Query result:
Encodes a URL string by replacing characters that aren't numbers or letters with percentage symbols and hexadecimal numbers.
encodeUrl(expression)
The data type of the returned value is string.
data record(content = "https://www.dynatrace.com/platform/grail")| fieldsAdd encodeUrl(content)
Query result:
Checks if a string expression ends with a suffix. Returns true if does, false otherwise.
endsWith(expression, suffix [, caseSensitive])
The data type of the returned value is boolean.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd endsWith(content, "awesome!"),endsWith(content, "AWESOME!", caseSensitive: false),endsWith(content, "Language")
Query result:
Returns an escaped string.
All other ASCII characters are represented as \xhh. This applies to the following characters
\uhhhh.escape(expression)
The data type of the returned value is string.
data record(content = """"foo@bar.com""")| fieldsAdd escape(content)
Query result:
| content | escape(content) |
|---|---|
"foo@bar.com | \"foo@bar.com |
Returns the character at a given position from a string expression. Negative values for the position parameter are counted from the end of the string. If a position refers to a position outside the string, the function returns NULL.
getCharacter(expression, position)
The data type of the returned value is string.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd getCharacter(content, 1),getCharacter(content, 17),getCharacter(content, -1)
Query result:
Returns the index of the first occurrence of a substring in a string expression.
Starts to search forward from a given index. Negative values for the from parameter are counted from the end of the string.
The default value for from is 0 (the search from the start of the string).
The search is case-sensitive.
If the defined substring is not found, the function returns -1.
indexOf(expression, substring [, from])
The data type of the returned value is long.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd indexOf(content, "a"),indexOf(content, "a", from: 10),indexOf(content, "Query")
Query result:
Parses a JSON string and extracts one value selected by its name.
jsonField(expression, fieldName [, seek])
The data type of the returned value is long, double, boolean, string, array or record.
data record(content = """{"name":"John","children":["Mallory", "Mary"],"address":{"city":"Boston", "zip":"02210"}}""")| fieldsAdd jsonField(content, "name")
Query result:
data record(content = """JSON: {"name": "John"} ...""")| fieldsAdd jsonField(content, "name", seek:false)| fieldsAdd jsonField(content, "name", seek:true)
Query result:
Parses a JSON string and extracts one value selected by a JSONPath expression.
jsonPath(expression, jsonPath [, seek])
The data type of the returned value is long, double, boolean, string, array or record.
data record(content = """{"name":"John","children":["Mallory", "Mary"],"address":{"city":"Boston", "zip":"02210"}}""")| fieldsAdd jsonPath(content, "$.children[0]")| fieldsAdd jsonPath(content, "$.address.city")| fieldsAdd jsonPath(content, "$['address']['zip']")
Query result:
data record(content = """JSON: {"name": "John"} ...""")| fieldsAdd jsonPath(content, "$.name", seek:false)| fieldsAdd jsonPath(content, "$.name", seek:true)
Query result:
Returns the index of the last occurrence of a substring in a string expression. Starts to search backward from a given index. Negative values for the from parameter are counted from the end of the string. The default value for from is -1 (search from the end of the string). The search is case-sensitive. If the substring is not found, the function returns -1.
lastIndexOf(expression, substring [, from])
The data type of the returned value is long.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd lastIndexOf(content, "a"),lastIndexOf(content, "a", from: 10),lastIndexOf(content, "Query")
Query result:
Computes the Levenshtein distance between two input strings.
levenshteinDistance(expression, expression)
The data type of the returned value is long.
data record(a = "DQL is awesome!", b = "Grail is awesome!"),record(a = "Dynatrace Query Language", b = "DQL"),record(a = "Dynatrace Query Language", b = "dynatrace query language")| fieldsAdd levenshteinDistance(a, b)
Query result:
Tests if a string expression matches a pattern. If the pattern does not contain percent signs, like() acts as the == operator (equality check). A percent character in the pattern (%) matches any sequence of zero or more characters. An underscore in the pattern (\_) matches a single character.
like(expression, pattern)
The data type of the returned value is boolean.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd like(content, "%DQL%"),like(content, "D%L%"),like(content, "D_L%")
Query result:
Converts a string to lowercase.
lower(expression)
The data type of the returned value is string.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd lower(content)
Query result:
Tests if a string expression matches the DPL pattern and returns true if it does, otherwise, returns false.
matchesPattern(expression, pattern)
The data type of the returned value is boolean.
data record(content = "2023-11-01 12:52:12 : 766"),record(content = "2023-11-01 12:53:00:123"),record(content = "2023-11-01 12:55:59 : 192.168.0.1")| fieldsAdd matchesPattern(content, "TIME ' : ' LONG"),matchesPattern(content, "TIME ' : ' IP")
Query result:
| content | matchesPattern(content, "TIME ' : ' LONG") | matchesPattern(content, "TIME ' : ' IP") |
|---|---|---|
2023-11-01 12:52:12 : 766 | true | false |
2023-11-01 12:53:00:123 | false | false |
2023-11-01 12:55:59 : 192.168.0.1 | false | true |
Matches a phrase against the input string expression using token matchers.
matchesPhrase(expression, phrase [, caseSensitive])
The data type of the returned value is boolean.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language"),record(content = array("DQL", "is", "awesome", "!", "Dynatrace Query Language"))| fieldsAdd matchesPhrase(content, "DQL"),matchesPhrase(content, "Dyna"),matchesPhrase(content, "query"),matchesPhrase(content, "query", caseSensitive: true)
Query result:
Searches records for a specific value in a given attribute. Returns true or false.
matchesValue(expression, value, … [, caseSensitive])
The data type of the returned value is boolean.
Values are matched case-insensitive by default:
data record(content = "User 'käärmanü' failed to login from 192.168.0.1")| fieldsAdd matchesValue(content, "User*"),matchesValue(content, "user*"),matchesValue(content, "user*", caseSensitive: true)
Query result:
Values are matched from the beginning. To match parts of the value, use * as wildcard symbol:
data record(content = "User 'käärmanü' failed to login from 192.168.0.1")| fieldsAdd matchesValue(content, "192.168.0.1"),matchesValue(content, "*192.168.0.1"),matchesValue(content, "*failed to log*")
Query result:
Only ASCII characters are matched case-insensitive:
data record(content = "Österreich")| fieldsAdd matchesValue(content, "österreich"),matchesValue(content, "Österreich")
Query result:
The function handles values of arrays in "any-match" manner.
data record(technologies = array("Java11", "java17"))| fieldsAdd matchesValue(technologies, "Java11"),matchesValue(technologies, "java"),matchesValue(technologies, "java*")
Query result:
The matchesValue() function supports matching against multiple patterns. You can use it by either providing an array or a list of patterns with the value parameter. Only strings are supported as patterns. Other datatypes don't produce a match and are ignored. The matchesValue() function returns true if any of the patterns matches. In case none of the patterns produce a match, false is returned.
data record(content = array("DQL", "is", "awesome", "!"))| fieldsAdd matchesValue(content, array("Grail", "dql")),matchesValue(content, {"Grail", "dql"}),matchesValue(content, {"Grail", "dq*"}),matchesValue(content, {"Grail", "dq*"}, caseSensitive: true)
Query result:
Extracts a single value from a string as specified in the pattern or a record if there are multiple named matchers.
parse(expression, pattern)
The parse function returns a single value, which can be either of primitive type or a record. The result is of primitive type in case of a single named matcher in the DPL pattern. If there are multiple named matchers in the pattern, then the result is a record containing fields corresponding to the names of the matchers.
Fields created from the output of the parse function by default get the name of the named matcher in the DPL pattern. In case of multiple named matchers in the pattern, the default field name is parsed_record. You can also define alternative field names using an alias expression.
data record(src = "1 2"),record(src = "45 46 47 48")| fieldsAdd parse(src, "LONG:result"),value = parse(src, "LONG:result"),parse(src, "LONG:field1 ' ' LONG:field2")
Query result:
| src | result | value | parsed_record |
|---|---|---|---|
1 2 | 1 | 1 | field1: 1field2: 2 |
45 46 47 48 | 45 | 45 | field1: 45field2: 46 |
Extracts several values from a string as specified in the pattern.
Unlike the parse function, parseAll returns an array all the time. The array can be empty if no patterns matched. A single element can be primitive type or a record.
parseAll(expression, pattern)
The data type of the returned value is array.
data record(src = "1 2"),record(src = "45 46 47 48")| fieldsAdd parseAll(src, "LONG:result"),value = parseAll(src, "LONG:result"),parseAll(src, "LONG:field1 ' ' LONG:field2")
Query result:
| src | result | value | parsed_records |
|---|---|---|---|
1 2 | [1, 2] | [1, 2] | [field1: 1 field2 2] |
45 46 47 48 | [45, 46, 47, 48] | [45, 46, 47, 48] | [field1: 45 field2 46, field1: 47 field2 48] |
Extracts punctuation characters out of an input string.
punctuation(expression, [, count] [, withSpace])
The data type of the returned value is string.
In this example, we extract the punctuation characters from each input string.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language"),record(content = "${placeholder}")| fieldsAdd punctuation(content),punctuation(content, count: 2),punctuation(content, count: 2, withSpace: true)
Query result:
Replaces each substring of a string that matches the DPL pattern with the given string. The pattern must be defined as a constant string expression. For additional details about pattern syntax, see the DPL documentation.
replacePattern(expression, pattern, replacement)
The data type of the returned value is string.
data record(content = "DQL 2019-08-01 09:30:00"),record(content = "Dynatrace Query L4nguage")| fieldsAdd replacePattern(content, "TIME", "is awesome!"),replacePattern(content, "LONG", "a")
Query result:
| content | replacePattern(content, "TIME", "is awsome!") | replacePattern(content, "LONG", "a") |
|---|---|---|
DQL 2019-08-01 09:30:00 | DQL is awesome! | DQL aaa a:a:a |
Dynatrace Query L4nguage | Dynatrace Query L4nguage | Dynatrace Query Language |
Replaces each substring of a string with a given string. This function replaces only exactly matched substrings from the original string to the replacement. Matching is case-sensitive and doesn't use any wildcards. All found patterns will be replaced if they do not intersect. For instance, replacing abcabca in a string with abca pattern produces only one replacement. Only the first occurrence at the beginning of the string will be replaced.
replaceString(expression, substring, replacement)
The data type of the returned value is string.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language"),record(content = "abcabca")| fieldsAdd replaceString(content, "awesome", "simple"),replaceString(content, "abca", "xyz")
Query result:
Splits a string into an array at each occurrence of the DPL pattern.
splitByPattern(expression, pattern)
The data type of the returned value is array.
data record(content = "one $1 two $4 three"),record(content = "foo $1000 bar"),record(content = "no separator"),record(content = "")| fieldsAdd splitByPattern(content, " ' $' LONG ' ' ")
Query result:
| content | splitByPattern(content, " ' $' LONG ' ' ") |
|---|---|
one $1 two $4 three | [one, two, three] |
foo $1000 bar | [foo, bar] |
no separator | [no separator] |
| empty string | [] |
Splits a string according to the parameters set.
Retrieves an array of substrings of the specified expression that are adjacent to occurrences of the given pattern.
Parameters are interpreted literally. For example, splitting www.dynatrace.org by . results in www and dynatrace and org.
Using an empty string as a pattern splits the string into one-byte substrings. For example, a split of four characters becomes an array of four strings having one byte each (splitting the "1234" expression results in array("1", "2", "3", "4")).
The non-ASCII characters are represented by multiple bytes. Splitting a string containing such characters by "" breaks these bytes apart into separate invalid strings.
If the pattern is not found in the expression, it returns an array that contains only the input expression.
If the expression starts with one or more occurrences of the pattern, an empty string will be added for each occurrence. For example, splitString("abc", "a") results in "", "bc". Analogically, empty strings are added if the pattern is found at the end of the expression.
An empty string is also added for adjacent occurrences of the pattern that do not border the start or end of the string. For example, splitString("abbc", "b") results in "a", "", "c".
If the pattern is empty, it splits the expression into one-byte substrings. For example, splitString("abc", "") results in "a", "b", "c".
splitString(expression, pattern)
The data type of the returned value is array.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd splitString(content, " "),splitString(content, "is"),splitString(content, ""),splitString(content, "XYZ")
Query result:
Checks if a string expression starts with a prefix. Returns true if does, false otherwise.
startsWith(expression, prefix [, caseSensitive])
The data type of the returned value is boolean.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd startsWith(content, "D"),startsWith(content, "dql", caseSensitive: false)
Query result:
Returns the length of a string expression. Length is defined as the number of UTF-16 code units, which is often the same as the number of characters in the string. In some cases, the number of characters is smaller than the number of UTF-16 code units, for example when Combining Diacritical Marks are used, or if characters outside the Basic Multilingual Plane (BMP), such as Emoji, are present.
If your use case requires consistent length for the same characters, consider ingesting strings after Unicode normalization.
No specific normalization form is guaranteed for Dynatrace-provided strings.
stringLength(expression)
The data type of the returned value is long.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language"),record(content = "🐕🦺")| fieldsAdd stringLength(content)
Query result:
Gets a code unit range using a start index (inclusive) and an end index (exclusive).
Returns an empty string if from >= to.
Indexes >=0 are relative to the start of the string and address consecutive characters from left to right, starting from the index position.
Indexes <=-1 are relative to the last character of the string and are used to address characters from the right side of an expression, for example, -2 is the penultimate character.
Positive indexes beyond the bounds of the string are assigned to the string length.
Negative indexes beyond the bounds of the string are equal to 0. For example, in the 321 string, the index -4 is beyond the bounds of the string therefore it equals 0. However, the index -2 is located within the bounds of that string and extracts 21 if used as a from the index.
The returned substring never starts or ends with an incomplete UTF-16 surrogate pair. Instead of that, it starts or ends with a question mark. This safeguards against the creation of invalid Unicode strings.
substring(expression [, from] [, to])
The data type of the returned value is string.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd substring(content, from: 4),substring(content, from: -2),substring(content, from: 4, to: 9),substring(content, from: -42, to: 42)
Query result:
Removes leading and trailing whitespaces. Any code point <= ASCII 32 in decimal is considered a whitespace, where ASCII 32 is a blank space.
trim(expression)
The data type of the returned value is string.
data record(content = " DQL is awesome!"),record(content = " Dynatrace Query Language ")| fieldsAdd trim(content)
Query result:
Returns an unescaped string.
\xhh within standard ASCII space (0x00 - 0x7f) is replaced by the related character.\xhh within extended ASCII space (0x80 - 0xff) is interpreted as \u00hh and replaced by the related Unicode character.\uhhhh is replaced by the related Unicode character.unescape(expression)
The data type of the returned value is string.
data record(content = """"foo\x40bar\u002ecom""")| fieldsAdd unescape(content)
Query result:
| content | unescape(content) |
|---|---|
"foo\x40bar\u002ecom | "foo@bar.com |
Unescapes HTML in a string by replacing ASCII characters with HTML syntax.
unescapeHtml(expression)
The data type of the returned value is string.
data record(content = "DQL is <bold>awesome</bold>!"),record(content = "<a href="https://www.dynatrace.com/platform/grail">Dynatrace Query Language</a>")| fieldsAdd unescapeHtml(content)
Query result:
Converts a string to uppercase.
upper(expression)
The data type of the returned value is string.
data record(content = "DQL is awesome!"),record(content = "Dynatrace Query Language")| fieldsAdd upper(content)
Query result: