parse-where

The parse-where operator lets you extract values from a string expression based on a pattern and at the same time filter out rows that don’t match the pattern. This operator is useful when you want to ensure that your results contain only rows where the parsing succeeds, reducing the need for an additional filtering step.

You can use parse-where when working with logs or event data that follow a known structure but may contain noise or irrelevant lines. For example, you can parse request logs to extract structured information like HTTP method, status code, or error messages, and automatically discard any rows that don’t match the format.

Usage

Syntax

parse-where [kind=kind [flags=regexFlags]] expression with [*] stringConstant columnName [:columnType] [*]

Parameters

Returns

The operator returns a table with the original columns and the newly extracted columns. Rows that don't match the parsing pattern are removed.

Use case example

You want to extract the HTTP method and status code from request logs while ignoring rows that don’t follow the expected format.

Query

['http-logs']
| parse-where uri with '/' method:string '/' * 'status=' status:string
| project _time, method, status, uri

Output

This query extracts the method and status from the uri field and discards rows where the uri doesn't match the pattern.

List of related operators

• extend: Adds calculated columns. Use when parsing isn't required but you want to create new derived columns.
• parse: Extracts values from a string expression without filtering out non-matching rows. Use when you want to keep all rows, including those that fail to parse.
• project: Selects and computes columns without parsing. Use when you want to transform data rather than extract values.
• where: Filters rows based on conditions. Use alongside parsing functions if you want more control over filtering logic.

Other query languages