I want to extract a field event_id from the below log with all values being captured by this field name.
The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]
Could some help me extract the field.
Assuming your single event contains the data you show above verbatim, i.e.
The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]
try this:
<yoursearch to find data> | rex max_match=0 "id=(?<event_id>\d+),"
This should give you a multi-value field called event_id which contains a list of all ids in the event. You can then do whatever you need to do with that.
Assuming your single event contains the data you show above verbatim, i.e.
The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]
try this:
<yoursearch to find data> | rex max_match=0 "id=(?<event_id>\d+),"
This should give you a multi-value field called event_id which contains a list of all ids in the event. You can then do whatever you need to do with that.