Anchor Parse & NRQL Variables: Parsing values from Log just got easier!

Anchor Parse

Need to extract a specific value from a string? Tired of using Regex Capture as it is complicated and arduous? We’re excited to announce Anchor Parse - A simplified way to parse out particular values from a string using *.


  • aparse(<string>, ‘<anchorstart>*<anchorend>’)
  • aparse(<string>, ‘%<anchorstart>*<middleanchor(s)>*<anchorend>%’)

* = Capturing wildcard, similar to capturing in regex capture
% = Non-capturing wildcard, as seen in the LIKE clause
NOTE: Anchor Parse is case-insensitive.

Example 1:

String = 'POST: http://carts/carts/57a body: {"itemId":"abc-123","unitPrice":12}\n'
Function = aparse(string, 'POST: * body: {"itemId":"*","unitPrice":*}\n')
Result = (http://carts/carts/57a, abc-123, 12)

As you can see, Anchor Parse lets you quickly and easily extract values from a string using *, and is much simpler than writing a Regex Capture function.

Example 2:

String = 'POST: http://carts/carts/57a body: {"itemId":"abc-123","unitPrice":12}\n'
Function = aparse(string, '%"itemId":"*","unitPrice":*}%')
Result = (abc-123, 12)

Sometimes you don’t know the full design of a string (especially for Logs). If you don’t want to fully match all of the text at the beginning and end of a string, simply use the wildcard % to zero in on the particular string you care about. In the example above we specifically look for the item Id and the unit price, regardless of what comes before or after it.

You may be asking: Now that I’ve extracted multiple values from a string, how do I use them? Well, we are also announcing:

NRQL Variables

NRQL Variables is a new way to store computed row-wise values (e.g. round, concat, anchor parse, etc.) into variables which can be referenced anywhere in the query. These variables can be reused in the query and makes querying much faster!

NRQL Variables are declared using the ‘WITH’ clause and must be placed at the beginning of a query (before FROM/SELECT, between FROM/SELECT, or directly after FROM/SELECT).

Consistent with other NRQL syntax, we declare the value first, and then give it an identifier using the ‘AS’ keyword. You can also create multiple NRQL Variables which reference each other.


  • WITH <evaluable> AS variable1
  • WITH <evaluable1>*10 AS variable2,
    variable2*10 AS variable3
  • WITH aparse(<string>, ‘one: *, two: *, three: *’) AS (one, two, three)

NOTE: Declared variables cannot start with a number or include the % symbol:

  • :no_entry_sign: WITH <evaluable> AS 1variable :no_entry_sign:
  • :no_entry_sign: WITH <evaluable> AS my%variable :no_entry_sign:

Also NOTE: You can only have one WITH clause per query.

Example 1:

FROM Transaction
WITH duration*1000 AS millisec
SELECT average(millisec)

Example 2:

WITH aparse(message, '%itemId":"*","unitPrice":*}%') AS (itemId, unitPrice),
numeric(unitPrice) AS unitPriceNum
FROM Log SELECT sum(unitPriceNum) FACET itemId

In this example you can see how easy it is to extract particular fields from a string, define them using NRQL Variables, and use these defined variables throughout the query. Note that when you extract values they return as strings, so numeric(unitPrice) changed the unit price from a string into a number.

We’re excited for you to parse your Logs in different ways, define a slew of NRQL Variables, and use the data extracted to build dashboards and alerts to help you fix incidents and better understand your data!

Related articles:
Regex Multi-Capture
Conditional IF

Click here to see NRQL Documentation on Anchor Parse.
Click here to see NRQL Documentation on NRQL Variables.

1 Like

Thanks for this post Alex. Some readers may also find this Blog post helpful:

1 Like