I have a single row event that populates the below values and i would like to extract eventid=389643 and STATUS=FINISHED using regex. Could you help me with the regex pattern to extract these values.
2017-10-30 06:48:03,357 [pool-22-thread-1] INFO xxxxxxxxxxxxxxxxxxxxxxx - Email Sent
To : xxxxxxxxxxxxxxxxxxxxxxxx
From : xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Subject : Plan Status - 389643 FINISHED
Body : Plan Status - 389643 FINISHED
Try this
| rex Status\s\-\s(?<eventid>\d+)
| rex -\s\d+\s(?<STATUS>\w+)
Try this: <yoursearch> | rex field=_raw "(?<eventID>\d+)\s(?<STATUS>\w+)$"
This assumes that there is nothing in the event after your status value (the RegEx anchors to the end of _raw)
... | rex "Subject : Plan Status - (?<eventID>\d+)\s(?<STATUS>\w+)"
will work if you have additional stuff after that last line.