I have some information I need to extract from the source field but I cannot do it for all cases:
Example:
I have these two sources
\/usr\/local\/dir-hello\/logs\/
\/usr\/local\/dir\/logs\/
So the REX for each will be:
rex field=source "\/usr\/local\/dir-hello\/logs\/(?
rex field=source "\/usr\/local\/dir\/logs\/(?
These REX works but I need:
rex field=source "\/usr\/local\/dir*\/logs\/(?
It does not work. How can I fix it?
Thanks,
Lp
rex uses regular expressions. You should be able to use greedy matches to extract a field named job from the fifth path segment in both of your sources with one expression. One example:
rex field=source "/usr/local/dir(?:[^/]+)?/logs/(?<job>[^/]+)/"
Or are you wanting job to be everything to the left of a period at end of the path? An example of that:
rex field=source "/usr/local/dir(?:[^/]+)?/logs/(?<job>[^\.]+)"
Thank you It worked.