field extraction a specific match in a field

[davidbarat]

Hello,

I have an issue with this type of log :

[5/22/20 14:46:23:381 GMT] 0000009c ThreadMonitor 3 UsageInfo[ThreadPool:hung/active/size/max]={server.startup:0/0/1/3,ProcessDiscovery:0/0/1/2,TCPChannel.DCS:0/2/4/20,HAManager.thread.pool:0/0/2/2,Default:0/2/6/20}

I create a regex which works :

rex field=_raw "\[(?[^\[]*)\]\s(?[^\s]*)\s(?[^\s]*)\s(?[^\s]*)\s(?.{11})(?\[\w.*\])(?[\=])\{((?\w.*?):(?\d+)\/(?\d+)\/(?\d+)\/(?\d+))+"                                                                                                                                                 | table timestamp threadname hung max

But the threadname is always the first match, in my case server.startup.

Is it possible to add a where clause to extract the desired threadname, for example HAManager ?
And I can't modify props.conf because I don't have admin right.

Thanks for your help

David

[DalJeanis · Accepted solution]

1) Always mark your code so HTML-like aspects <threadname>don't get stripped out by the forum.

2) If you want to find all matches, use the max_match=0 parameter to get all matches for your rex.

3) if you are looking for only the value of a fixed name like HAManager.thread.pool:0/0/2/2,, then just use that name as your rex.

| rex field=_raw "HAManager.thread.pool:(?<threadpoolvalue>[^,]+)"

4) If you are looking for ALL values, then rex JUST the relevant matchable items.

| rex field=_raw max-match=0 "\b(?<threadpoolname>[^:]+):(?<threadpoolvalue>\d+\/\d+\/\d+\/\d+)\b"

Those are aircode, so they may require some adjustment.

[davidbarat]

Thanks @DalJeanis I have modified my request by adding a fixed name and it's work fine.
I will modify my original post to display the code @richgalloway .
Thanks both of you.
David

[richgalloway]

I've formatted the question to display the query as code. Please edit it to show the correct regular expression.