As of now I am using:
rex field=URI mode=sed "s/=[^?]+/=xxx/g"
But its not working
/v1/mb/members/15d628b4-0d113-09b8ec770efd/option
/v1/mb/members/216570ce-c199-4ab9--c0cf3ddd404e/option
/v1/mb/members/36fbe9a8-882d-4a94-882561f81074/option
/v1/mb/members/4d573446-1d4f-483a-c5d64c33/option
/v1/mb/members/5cc2fa84-4b91-45bf-9c1/option
Your current rex is telling the system to replace an =
, followed by any number of things that are not ?
, with xxx
.
If you explain what you want it to do, then we can help you.
can you please post sample log entries and what do u want to extract/replace from those log entries.
rex field=URI mode=sed "s/[^?]+/xxx/g"