Hi ,
I am trying to extract each line having a keyword, till the end of that line.
below is my data and the query I tried so far.
my query | rex "RefillService(?P(.+)\s+)" | table myfield
its only showing first matching line "Start CalRefillService in refillRequestHandler"
DEBUG 2017-05-04 10:23:23,128 260497545ms refillWebApiController GetrefillData - =============================================
DEBUG 2017-05-04 10:23:23,128 260497545ms refillWebApiController GetrefillData - Processing Start:2017-5-4 10:23:23.128296
DEBUG 2017-05-04 10:23:23,190 260497608ms refillRequestHandler RefillService - Start CalRefillService in refillRequestHandler
DEBUG 2017-05-04 10:23:23,211 260497628ms refillRequestHandler RefillService - Completed basic validation in refillRequestHandler
DEBUG 2017-05-04 10:23:23,225 260497643ms refillRequestHandler RefillService - Generated Account code in refillRequestHandler
DEBUG 2017-05-04 10:23:23,225 260497643ms refillRequestHandler RefillService - Generated quote in refillRequestHandler
DEBUG 2017-05-04 10:23:23,241 260497658ms refillRequestHandler RefillService - Generated RequestXml in refillRequestHandler
DEBUG 2017-05-04 10:23:23,241 260497658ms refillResponseHandler ProcessResponse - Start ProcessResponse in refillResponseHandler: 2017-5-4 10:23:23.241291
DEBUG 2017-05-04 10:23:23,241 260497658ms refillResponseHandler ProcessResponse - Completed validations in refillResponseHandler
DEBUG 2017-05-04 10:23:23,241 260497658ms refillResponseHandler ProcessResponse - Call Start: 2017-5-4 10:23:23.241291
Hello there,
This will extract both lines from both keyworkds (RefillService, ProcessResponse):
| rex "(?:RefillService|ProcessResponse)\s-\s(?<my_custom_field1>[^\n]+)"
This will work only for RefillService line:
| rex "RefillService\s-\s(?<RefillService>[^\n]+)"
Hope it helps.