I want to extract the PHP Message as a field so I can have all the various php error messages:
2016/10/20 21:23:18 [error] 26550#26550: *9254611 FastCGI sent in stderr: "PHP message: PHP Warning: trim() expects parameter 1 to be string, array given in /var/www/html/xx/xxxx-xx.xxxx.xxx.com/wordpress/wp-includes/option.php on line 247" while reading response header from upstream, client: 0.0.0.00, server: _, request: "GET / HTTP/1.1", upstream: "fastcgi://000.0.0.1:9000", host: "xxx.xx.com"
Give this a try
your base search | rex "PHP message\: (?<PHPError>[^\"]+)"
Give this a try
your base search | rex "PHP message\: (?<PHPError>[^\"]+)"
thanks
that did work
so this could not have been possible with the IFX right?
I think it would. Be sure to select the whole string that you want to extract OR you can specify your own regex (this one) in the IFX to save it.