Hi,
I have an application that calls other external applications/systems. I wish to plot the calls to external systems per server.
My log files look like this,
I have managed to extract a separate field, calls to external systems i.e. the value highlighted above. I need to further extract other values from this field. What I need is stated below,
**
Can you please tell me the rex command to be used?
**
NOTE: All values used in this question are dummy placeholders, and are not original configurations.
Thanks in advance.
I don't think you can get all scenarios in one regex. You may be better off (reliability wise) creating separate regex. Something like this
... | rex field=fieldextractedfromraw "(?<addtional_info>http.*)\/" | rex field=fieldextractedfromraw "Client invoked\s(?<addtional_info>.*)" | eval additonal_info=coalesce(additional_info, fieldextractedfromraw)
I don't think you can get all scenarios in one regex. You may be better off (reliability wise) creating separate regex. Something like this
... | rex field=fieldextractedfromraw "(?<addtional_info>http.*)\/" | rex field=fieldextractedfromraw "Client invoked\s(?<addtional_info>.*)" | eval additonal_info=coalesce(additional_info, fieldextractedfromraw)