parse

Definition

Explore More Terms

Examples & Use Cases

```
| parse Message with "User: " User ", Action: " Action
```
If `Message` contains: User: Alice, Action: Login

It will produce to 2 new columns (**User**, **Action**) on top of the existing table, where in this case:

* User = Alice  
* Action = Login

---
### Parsing Multiple Fields
```
| parse Message with "IP=" IP " User=" User " Status=" Status
```
This extracts multiple values from a structured log message into separate columns.

---

### Using Wildcards

You can use `*` to skip unwanted parts of the text:
```
| parse Message with * "Error: " ErrorMessage
```
This extracts everything after “Error:” into a new column.

---

### Typed Parsing

You can specify data types while parsing:
```
| parse Message with "Age: " Age:int ", Name: " Name
```

This converts `Age` into an integer automatically.

---

### Why it matters

Logs and telemetry data are often stored as raw text. Without parsing, it is difficult to filter, group, or analyze specific values.

* Converts unstructured text into structured columns  
* Makes filtering and aggregation easier  
* Helps uncover insights hidden in log data

However, `parse` relies on consistent patterns. If the format varies, extraction may fail or return null values.

---

## Further Reading
- [Microsoft Learn - parse operator](https://learn.microsoft.com/en-us/kusto/query/parse-operator)