Hi I have event logs where
rex under field extraction, to extract each value following a string and stopping at first coma, and avoid duplicates
example :
hcyycuvubuv : 45544.466, "disk_byte" :23.45667, "disk_byte_quota": 23.345t,
in above string, I am only looking for numbers that come after "disk_byte" :
, which is 23.45667
problem is, in my events the disk_bytes string is not at the same location in logs and there's disk_bytes_quota which should be ignored.
example :
first event
chhchvhvh: 223. 455, "disk_byte" :23.45667,"disk_byte_quota": 23.345t,
gghffvhh:3455
second event
chhchvhvh: 223. 455, tuvjvujjvg:3456.566, "cpu_percentage":23.45677,gghffvhh:3455.788,"disk_byte" :23.45667, "disk_byte_quota": 23.345t,
The regex string "disk_byte"\s:(?[\d.]+)" will extract the "disk_byte" field and ignore the "disk_bytes_quota" field.
The regex string "disk_byte"\s:(?[\d.]+)" will extract the "disk_byte" field and ignore the "disk_bytes_quota" field.
hi i am having similar issues,
with msg field
it's has different values can be numbers, strings, path, punctuations, blank space like shown below.
"msg" :"35556"
"msg" :"<<÷] {<} ;;"
"msg" :"ycuvuuu jvbigg buivuv"
"msg" :" "
now problem is, i have written rex as
\msg\":(? \". *\") \,
but it returns value which following msg field.
"msg" :"vjvuv igivc uvviv", "origin" :"abcgc", "time" :23.45677",