Hi
I have a log like that :
2014-29-08 08:28:45,817.366 - INFO - message1
2014-29-08 08:28:45,817.366 - WARN - message2 ID = 458315
2014-29-08 08:28:45,817.366 - DEBUG- message3 ID = 8
2014-29-08 08:28:45,817.366 - INFO - message4
I want to extract message1, message2, message3 and message4 in the same field "App_message".
I try this but it's not working :
rex "\s-\s+(?<App_level>[A-Z]+)\s*-\s+(?<App_message>.+)(?:ID\s=\s[0-9]+)?"
Help pls 🙂
Assuming the message actually is longer than just a word, you can do this based off your original regex:
rex "\s-\s+(?<App_level>[A-Z]+)\s*-\s+(?<App_message>.+?)(?:\s*ID\s=\s[0-9]+)?"
All I did was make the .+
non-greedy and added a \s*
to the start of the optional end.
Assuming the message actually is longer than just a word, you can do this based off your original regex:
rex "\s-\s+(?<App_level>[A-Z]+)\s*-\s+(?<App_message>.+?)(?:\s*ID\s=\s[0-9]+)?"
All I did was make the .+
non-greedy and added a \s*
to the start of the optional end.
Ah yeah, adding the end-of-line anchor is necessary.
The message can be something like :
cCMSyncManager::LCRRerunperARNThread::Send ABDCng Requestfor ARN = F-WWTF, with TransactionID = 1857182350
or
cCMSyncManager::UpdateDatabaseThreshold::Data is pushed for deleting ARN::F-WWTF, TLM = WIREDand StreamID = 12
I just want extract the message without the "ID= ..." sequence.
I did a mistake in my original post : there is no space between "App_message" and the "ID = ..."
You should take @martin_mueller's rex, remove the \s
he added (since you've since stated it's not really there), and then instead of making the ID part optional with ?
, make that clause something that either matches the ID part or the end of the line:
rex "\s-\s+(?<App_level>[A-Z]+)\s*-\s+(?<App_message>.+?)((?:ID\s=\s\d+)|$)"
Ohhhh nice, it's working now ! 🙂
Really thank you !
Replacing
(?<App_message>.+)
with
(?<App_message>\w+)
should help.
But "App_message" can contain many caracters and not only alphanumeric :
( : ; - \ [ " ' $ ....