Hi , I need to extract the value FISOBPIT10101 from the below lines.
message:PSUS7|8897|FISOBPIT10101|OWA|8897|8897|SignOnID|SPT|adding routing key in producer
Depending on whether the leading phrase "message" and the trailing phrases such as "adding routing key in producer" are important, you can use rex or just
| eval of_interest = mvindex(split(your_field, "|"), 2)
| rex field=your_field "message:(\d+|){2}(?<of_interest>\w+)(|\d+){5}|adding routing key in producer"
Hi , I need this value only FISOBPIT10101
| rex "([^|]+\|){2}(?<field>FISOBPIT10101)"
You could go with | erex , if you're not expert with RegExs.
Otherwise, assuming the value is always in that position and not assuming a specific set of alphanumeric values, go with the following (13 steps per log, very efficient)
| rex field=<yourFieldOr_raw> "^(?:[^\|\v]*+\|){2}(?<yourValue>[^\|\v]*)"