I am trying to remove all content returned in a field between two specific strings but only from the first occurrence of these strings.
I need to do this for a few sections of a log, strings I need to replace look like this:
[code= and ] : replace with empty string
[txid= and ] : replace with empty string
"code":"someCode" : either replace with empty string or only replace the "someCode" section.
Example log:
{"status":500,"statusDesc":"Internal Server Error","code":"someCode","message":"some error message"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }
I want the result to be:
{"status":500,"statusDesc":"Internal Server Error","message":"some error message"}
I am essentially trying to remove unique identifiers from this entry so that I can dedup based on the generic log error.
Hi Wondergoat77,
try this rex
SPL which uses mode=sed
to removes the various strings:
| makeresults
| eval foo="{\"status\":500,\"statusDesc\":\"Internal Server Error\",\"code\":\"someCode\",\"message\":\"some error message\"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }"
| rex field=foo mode=sed "s/\[[^\]]+\]|\s\}|\"code\":\"[^\"]+\"//g"
The result looks like this:
Hope this helps ...
cheers, MuS
Thanks this did exactly what i needed, much appreciated.
Awesome, feel free to accept the answer so it is marked as answered 😉
cheers, MuS
Like this:
Your Search Here
| rex "^{(?<curlytext>[^}]+)"
| dedup curlytext