How to write regex to extract my fields at search-time?

[gudavasr]

Hi,
I have these entries in the log. I am trying to extract fields
FINISHED and ERROR_RUNNING for this.
But I am able to get only one field FINISHED.

I tried extracting fields using the interactive field extractor from GUI, but was not able to solve the issue. I even tried this:

rex field=_raw " finished with status:(?<jobstatus>.*)"

Can someone help? Below is an example of my log entries.

finished with status:FINISHED
finished with status:ERROR_RUNNING

---

UPDATE:

Here is full log entries; I tried without leading space..still had issue:

Job with id: VolckerVega|FX_MASTER_StepUp|VOLCKER_TF_Y_FX_MASTER_StepUp_CancellableSwap_1|SABR_GRID_ALPHA finished with status:FINISHED
Job with id: VolckerVega|MASTER|VOLCKER_TF_Y_MASTER_Swap_1|MO_CF_QTR_HDG finished with status:ERROR_RUNNING
At least one job has failed. Will not exit with system code = 0
Job with id: VolckerVega|MASTER_FPA|VOLCKER_TF_Y_MASTER_FPA_FPA_1|Volcker_FPA_Vega finished with status:ERROR_RUNNING
At least one job has failed. Will not exit with system code = 0

[kristian_kolb]

Well, if it is all in one event, you should be able to use a multivalued field (see the docs on rex) and use/retrieve the individual values with the mvindex() function for eval.

Best of luck.

/k

[gudavasr]

I made this work with transforms and props.conf.
sorry for the bad question.

[gudavasr]

I am very sorry. This is 1 event. what is better way to extract multiple fields from 1 event with multiple lines?

[norbert_hamel]

If you want to fetch everything between the colon and the end of line you could try:

| rex field _raw "^.*:(?<jobstatus>.*?)$"

[richgalloway]

I put your sample data and your rex string into RegExr and got both jobstatus values back. Perhaps kristian.kolb is correct and your log entries are not being handled as separate events.

[kristian_kolb]

Are you sure that these are separate events? If not, perhaps you need to add the max_match parameter to rex to create a multivalued field?

[kristian_kolb]

You have a leading space as part of your rex statement, could that be the culprit.

I think you should perhaps post a few full events, not just the the partial events.

/k