2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }
This is just n example . With the rex query I want to list all codes with respMessage
Below rex Query gets me respCode and respMessage part as only "Declined"
rex field=msg "responseCode: (?.[a-z0-9A-Z_-]+)"| rex field=msg "responseMessage: (?.[a-z0-9A-Z_-]+)
| makeresults
| eval _raw ="2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }"
| rex mode=sed "s/(\w+): (.+?)(?= \w+\:| })/\"\1\": \"\2\",/g"
| rex "(?<json>\{.+\})"
| spath input=json
make JSON by force.
Hey Harish,
Assuming you want everything in between responseMessage and orderId.
You could use the below SPL.
Replace your query in the line before the rex command.
Please try and let us know
|makeresults
|eval _raw ="2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }"
|rex field=_raw "responseMessage:(?P<response_message>.+)orderId"
| table response_message
Assuming responseMessage is always followed by orderId, this should work.
rex field=msg "responseCode: (?.[a-z0-9A-Z_-]+)"| rex field=msg "responseMessage: (?.[a-z0-9A-Z_-]+) orderId"