Parse operators

Table of Contents

parse anchor
parse json
parse regex
split

Parse operators enable you to extract specific fields from log messages during query execution. They provide a flexible ad hoc method for processing data and refining queries. When using parse operators, you can extract valuable information dynamically and tailor queries to specific use cases.

parse anchor

Extracts a substring from a log line by specifying fixed start and stop anchor strings with a * wildcard placeholder. Use parse anchor for predictable, delimited log formats where the value you want always appears between two known literal strings.

Syntax

| parse "<start_anchor>*<stop_anchor>" as <field>
| parse "<start_anchor>*<stop_anchor>" as <field> nodrop
| parse [field=<source_field>] "<start_anchor>*<stop_anchor>" as <field>

none

Parameters

Parameter Required Description

Parameter	Required	Description
`"<start_anchor>*<stop_anchor>"`	Required	Pattern string with exactly one wildcard. Text before is the start anchor; text after is the stop anchor. The `*` captures everything between them.
`as <field>`	Required	Name of the output field that receives the captured value.
`nodrop`	Optional	By default, log lines that do not match the pattern are dropped. Specify `nodrop` to retain non-matching lines (the output field will be null).
`field=<source_field>`	Optional	Parse from a specific extracted field rather than the full log line (`_kf_msg`).

"<start_anchor>*<stop_anchor>"

Required

Pattern string with exactly one wildcard. Text before is the start anchor; text after is the stop anchor. The * captures everything between them.

as <field>

Required

Name of the output field that receives the captured value.

nodrop

Optional

By default, log lines that do not match the pattern are dropped. Specify nodrop to retain non-matching lines (the output field will be null).

field=<source_field>

Optional

Parse from a specific extracted field rather than the full log line (_kf_msg).

Example

Parse the HTTP method from nginx access log lines. The method appears between " (quote after the space) and the next space in the request field.

source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| count as requests by method

Expected output
method	requests
GET	1,412,840
POST	198,233
OPTIONS	257,234

Each in the pattern captures exactly one field. Use as many wildcards as fields you want to extract, with matching as <field1>, <field2>, … aliases separated by commas. For more complex patterns with named capture groups, use parse regex. The nodrop option is useful when parsing optional fields that are absent in some log lines.

parse json

Extracts one or more fields from JSON-formatted log lines using key names or JSONPath expressions. parse json is ideal for structured application logs where fields are already encoded as JSON — it eliminates the need for regex patterns and handles nested keys and arrays automatically.

Syntax

| json "<key>"[, "<key2>", ...] [as <alias> ...]
| json "<key>"[, "<key2>", ...] [as <alias>] [nodrop]
| json [field=<source_field>] "<key>"[, "<key2>", ...] [as <alias> ...]
| json "<parent>.[*].<child>" multi type=["string" | "int" | "double"]

none

Parameters

Parameter Required Description

Parameter	Required	Description
`"<key>"`	Required	A top-level key name or dotted JSONPath (e.g., `"user.details.age"`). Multiple keys are comma-separated.
`as <alias>`	Optional	Renames the extracted field. When extracting multiple keys, supply one alias per key in order.
`nodrop`	Optional	Retain log lines that do not contain the specified key (the output field will be null). By default, non-matching lines are dropped.
`field=<source_field>`	Optional	Parse from a specific field rather than the full log line.
`multi type=`	Optional	Used with array paths (`.[*].`) to extract array elements. Specify the element type: `"string"`, `"int"`, or `"double"`.

"<key>"

Required

A top-level key name or dotted JSONPath (e.g., "user.details.age"). Multiple keys are comma-separated.

as <alias>

Optional

Renames the extracted field. When extracting multiple keys, supply one alias per key in order.

nodrop

Optional

Retain log lines that do not contain the specified key (the output field will be null). By default, non-matching lines are dropped.

field=<source_field>

Optional

Parse from a specific field rather than the full log line.

multi type=

Optional

Used with array paths (.[*].) to extract array elements. Specify the element type: "string", "int", or "double".

Example

Extract the method and status fields from JSON-formatted application logs, then count requests per method and status code.

source="app-json"
| json "method", "status" as http_method, http_status
| count as requests by http_method, http_status

Expected output
http_method	http_status	requests
GET	200	842,301
POST	201	97,443
GET	404	12,087

Use dotted paths to reach nested fields: json "user.details.age" as age. To extract array elements, use the .[]. notation with multi: json "users.[].score" multi type="int". After extraction, FuseQL coerces string-typed numeric values automatically in aggregation contexts. The nodrop option is essential when the JSON key is present in only some log lines.

parse regex

Extracts fields from log lines using regular expressions with named capture groups. Use parse regex when log formats are complex or variable — for example, when the field you want is not surrounded by fixed anchor strings, or when you need to match multiple alternative formats.

Syntax

| parse regex "<pattern>(?P<field_name><expression>)<pattern>"
| parse regex "<pattern>(?P<field_name><expression>)<pattern>" nodrop
| parse regex [field=<source_field>] "<pattern>(?P<field_name><expression>)<pattern>"

none

Parameters

Parameter Required Description

Parameter	Required	Description
`"<regex>"`	Required	A regular expression containing one or more named capture groups in the format `(?P<field_name>pattern)`. Each named group becomes an output field.
`nodrop`	Optional	Retain log lines that do not match the regex (output fields will be null). By default, non-matching lines are dropped.
`field=<source_field>`	Optional	Apply the regex to a specific extracted field rather than the full log line.

"<regex>"

Required

A regular expression containing one or more named capture groups in the format (?P<field_name>pattern). Each named group becomes an output field.

nodrop

Optional

Retain log lines that do not match the regex (output fields will be null). By default, non-matching lines are dropped.

field=<source_field>

Optional

Apply the regex to a specific extracted field rather than the full log line.

Example

Extract the HTTP method and URL path from nginx log lines using named capture groups, then count requests grouped by method.

source="nginx"
| parse regex "\"(?P<method>GET|POST|PUT|DELETE|OPTIONS) (?P<path>[^ ]+)"
| count as requests by method

Expected output
method	requests
GET	1,412,840
POST	198,233
OPTIONS	257,234

Named capture groups use the Python-style syntax (?P<name>pattern). Each group name becomes a new field in the output row. For simpler patterns with fixed delimiters, parse anchor is easier to write and read. Use nodrop when the regex matches only a subset of log lines and you want to preserve the non-matching rows for later filtering.

parse regex performs a substring match — the pattern only needs to match somewhere within the log line, not the entire line. This is the opposite of the =~ filter operator, which anchors patterns by default. You do not need to wrap your pattern in .* to find a match within a longer line.

split

Splits a string field on a delimiter and extracts sub-fields by position or index. Use split to parse delimited log formats such as CSV, tab-separated values, or colon-delimited key-value strings where each position carries a known meaning.

Syntax

| split <field> extract <A>, <B>, ...
| split <field> extract 0 as <A>, 1 as <B>, ...
| split <field> extract <A>, <B>, 4 as <E>, <F>
| split <field> delim='<d>' escape='<e>' quote='<q>' extract <A>, <B>, ...

none

Parameters

Parameter Required Description

Parameter	Required	Description
`<field>`	Required	The string field to split. Use `_kf_msg` to split the raw log line.
`extract <aliases>`	Required	Specifies which sub-fields to extract. Use positional aliases (`<A>, <B>`) or index-based aliases (`0 as <A>, 1 as <B>`). Use `_` to skip a position.
`delim='<d>'`	Optional	Delimiter character. Defaults to `,` (comma).
`escape='<e>'`	Optional	Escape character. Defaults to `\` (backslash).
`quote='<q>'`	Optional	Quote character. Defaults to `"` (double quote).

<field>

Required

The string field to split. Use _kf_msg to split the raw log line.

extract <aliases>

Required

Specifies which sub-fields to extract. Use positional aliases (<A>, <B>) or index-based aliases (0 as <A>, 1 as <B>). Use _ to skip a position.

delim='<d>'

Optional

Delimiter character. Defaults to , (comma).

escape='<e>'

Optional

Escape character. Defaults to \ (backslash).

quote='<q>'

Optional

Quote character. Defaults to " (double quote).

Example

Split a comma-separated access log field and extract the timestamp, level, and message.

source="csv-app"
| split _kf_msg extract 0 as log_timestamp, 1 as log_level, 2 as log_message
| count as events by log_level

Expected output
log_level	events
ERROR	4,821
WARN	18,204
INFO	843,291

The three custom characters (delimiter, escape, quote) must all be distinct single characters. Positions are zero-indexed: the first sub-field is index 0. Use _ (underscore) to skip a position you do not need. For more complex extraction logic, combine split with parse regex.