I'm having problem with a multi-line field extraction which I have been struggling to figure out.
Below the log files ..
2018-01-02T13:24:30,503|[http-nio-8181-exec-4]|INFO|VM1|DocumentUploadRestController|DE0F4345165F89085E86221B49F86C02|5fac4fca-3dda-4f56-ac9d-f46889badcc9|TESTC01|Normal|A01|11071|1658049|147213323|null|SUCCESS|ImageByte
2018-01-02T13:28:19,420|[http-nio-8181-exec-7]|INFO|VM2|RestController|9E6D1D1CCEB59143C66A3A3FBC050692|5c191357-c436-4577-8896-ab983997cb65|1323574285.736696.48319626.2018167121.17362971%40-1983397168.17368709|TEST02|Normal|A02|2265|14388|147213326|null|SUCCESS|Multipart
2018-01-02T13:08:06,661|[http-nio-8181-exec-8]|INFO|VM3|DocumentUploadRestController|59BC5ADE721BF054A874FF6EF735E71D|46ca1a17-f35f-4193-9192-cc6c8d66d219|-603590707.736696.46257691.1596685263.27318499|TEST03|Normal|A03|18|264360|null|null|Invalid error message Number|Multipart
i m trying to extract the Fields Date, VM, and from user id (TEST01,TEST02) all the fields. for the first line is not matching with other 2 lines.. so i m trying to get the details sing below query but i m not getting Proper Result.
^(?P[^|]+)[^]\n]]|\w+|(?P\w+)(?:[^|\n]|){5}(?P[^|]+)
for the first line instead of user id TESTC01 its extracting next vale as "Normal".
Can yo please help me to extract the fields for the uneven lines log files
hey try this!!
| rex field=_raw "^(?P<date>[^\|]+)\|\[.*\]\|\w+\|(?P<VM>\w+)((.*\.\d+\|)|(.*\-\w+\|))(?P<user_id>[^\|]+)"
let me know if this helps you!
hey try this!!
| rex field=_raw "^(?P<date>[^\|]+)\|\[.*\]\|\w+\|(?P<VM>\w+)((.*\.\d+\|)|(.*\-\w+\|))(?P<user_id>[^\|]+)"
let me know if this helps you!
thank you so much .. the above is working fine
Hi rajeswariramar,
Try to use auto-field-extractor with delimiter "|" instead of regex.
can you put your regex in 101010
sample code? as it is not properly showing
^(?P<TimeFrame>[^|]+)[^]\n]]|\w+|(?P<*VM>\w+)(?:[^|\n]|){5}(?P<*userid>[^|]+)