I would like to extract the field of "/home/y/conf/video_dir.conf" with regex when the event contains "critical" keyword (there are some other state keywords like "normal", "debug")
2011-01-01 01:49:00 UTC [ critical] [ PID=14154][ GENERAL] File /home/y/conf/video_dir.conf doesn't exist or not readable.
I ran '... | rex field=_raw "^.critical.*File\s+(?)\s+.$" but it's not working. Any advice on making it work?
Please try -
sourcetype="video" | rex field=_raw "critical.*File\s(?<dir>.*)\sdoes" | table _raw dir