Parse operators :: Kloudfuse Docs
Parse operators
Parse operators enable you to extract specific fields from log messages during query execution. They provide a flexible ad hoc method for processing data and refining queries. When using parse operators, you can extract valuable information dynamically and tailor queries to specific use cases.
parse anchor
Extracts a substring from a log line by specifying fixed start and stop anchor strings with a * wildcard placeholder. Use parse anchor for predictable, delimited log formats where the value you want always appears between two known literal strings.
Syntax
| parse "<start_anchor>*<stop_anchor>" as <field>
| parse "<start_anchor>*<stop_anchor>" as <field> nodrop
| parse [field=<source_field>] "<start_anchor>*<stop_anchor>" as <field>
Parameters
| Parameter | Required | Description |
|---|---|---|
"<start_anchor>*<stop_anchor>" |
Required | Pattern string with exactly one * wildcard. Text before * is the start anchor; text after is the stop anchor. The * captures everything between them. |
as <field> |
Required | Name of the output field that receives the captured value. |
nodrop |
Optional | By default, log lines that do not match the pattern are dropped. Specify nodrop to retain non-matching lines (the output field will be null). |
field=<source_field> |
Optional | Parse from a specific extracted field rather than the full log line (_kf_msg). |
Example
Parse the HTTP method from nginx access log lines. The method appears between " (quote after the space) and the next space in the request field.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| count as requests by method
| method | requests |
|---|---|
| GET | 1,412,840 |
| POST | 198,233 |
| OPTIONS | 257,234 |
parse json
Extracts one or more fields from JSON-formatted log lines using key names or JSONPath expressions. parse json is ideal for structured application logs where fields are already encoded as JSON — it eliminates the need for regex patterns and handles nested keys and arrays automatically.
Syntax
| json "<key>",["<key2>", ...] [as <alias> ...]
| json "<key>",["<key2>", ...] [as <alias>] [nodrop]
| json [field=<source_field>] "<key>",["<key2>", ...] [as <alias> ...]
| json "<parent>.[*].<child>" multi type=["string" | "int" | "double"]
Parameters
| Parameter | Required | Description |
|---|---|---|
"<key>" |
Required | A top-level key name or dotted JSONPath (e.g., "user.details.age"). Multiple keys are comma-separated. |
as <alias> |
Optional | Renames the extracted field. When extracting multiple keys, supply one alias per key in order. |
nodrop |
Optional | Retain log lines that do not contain the specified key (the output field will be null). By default, non-matching lines are dropped. |
field=<source_field> |
Optional | Parse from a specific field rather than the full log line. |
multi type= |
Optional | Used with array paths (.[*].) to extract array elements. Specify the element type: "string", "int", or "double". |
Example
Extract the method and status fields from JSON-formatted application logs, then count requests per method and status code.
source="app-json"
| json "method", "status" as http_method, http_status
| count as requests by http_method, http_status
| http_method | http_status | requests |
|---|---|---|
| GET | 200 | 842,301 |
| POST | 201 | 97,443 |
| GET | 404 | 12,087 |
parse regex
Extracts fields from log lines using regular expressions with named capture groups. Use parse regex when log formats are complex or variable — for example, when the field you want is not surrounded by fixed anchor strings, or when you need to match multiple alternative formats.
Syntax
| parse regex "<pattern>(?P<field_name><expression>)<pattern>"
| parse regex "<pattern>(?P<field_name><expression>)<pattern>" nodrop
| parse regex [field=<source_field>] "<pattern>(?P<field_name><expression>)<pattern>"
Parameters
| Parameter | Required | Description |
|---|---|---|
"<regex>" |
Required | A regular expression containing one or more named capture groups in the format (?P<field_name>pattern). Each named group becomes an output field. |
nodrop |
Optional | Retain log lines that do not match the regex (output fields will be null). By default, non-matching lines are dropped. |
field=<source_field> |
Optional | Apply the regex to a specific extracted field rather than the full log line. |
Example
Extract the HTTP method and URL path from nginx log lines using named capture groups, then count requests grouped by method.
source="nginx"
| parse regex \"(?P<method>GET|POST|PUT|DELETE|OPTIONS) (?P<path>[^ ]+)\"
| count as requests by method
| method | requests |
|---|---|
| GET | 1,412,840 |
| POST | 198,233 |
| OPTIONS | 257,234 |
split
Splits a string field on a delimiter and extracts sub-fields by position or index. Use split to parse delimited log formats such as CSV, tab-separated values, or colon-delimited key-value strings where each position carries a known meaning.
Syntax
| split <field> extract <A>, <B>, ...
| split <field> extract 0 as <A>, 1 as <B>, ...
| split <field> extract <A>, <B>, 4 as <E>, <F>
| split <field> delim='<d>' escape='<e>' quote='<q>' extract <A>, <B>, ...
Parameters
| Parameter | Required | Description |
|---|---|---|
<field> |
Required | The string field to split. Use _kf_msg to split the raw log line. |
extract <aliases> |
Required | Specifies which sub-fields to extract. Use positional aliases (<A>, <B>) or index-based aliases (0 as <A>, 1 as <B>). Use _ to skip a position. |
delim='<d>' |
Optional | Delimiter character. Defaults to , (comma). |
escape='<e>' |
Optional | Escape character. Defaults to \ (backslash). |
quote='<q>' |
Optional | Quote character. Defaults to " (double quote). |
Example
Split a comma-separated access log field and extract the timestamp, level, and message.
source="csv-app"
| split _kf_msg extract 0 as log_timestamp, 1 as log_level, 2 as log_message
| count as events by log_level
| log_level | events |
|---|---|
| ERROR | 4,821 |
| WARN | 18,204 |
| INFO | 843,291 |