Hi,
i want to extract account field and i have events in 2 patterns. One where account has boundaries of @account= and right boundary as & as shown in event 1
2nd pattern is having @account as left boundary and left boundary as space
Event1 pattern is working fine but Event2 gives the whole event after account= which is 123452 HTTP/1.1" 200 1216 109354 "-" "-" "-"
What should i have just to have the account value from Event2 pattern
Event1
?product=%20FILTERS%2016z20r2&account=12334312&country=US HTTP/1.1" 200 3388 218391 "-" "-" "-" "-" "-" "-" "-" "-" "-" "-" "
Event2
?product=2CSY1&account=123452 HTTP/1.1" 200 1216 109354 "-" "-" "-"
Expression used:
(?i)&account=(?P
This should work:
(?i)&account=(?P
Tested ok on regex101.com with the two events you gave.
This should work:
(?i)&account=(?P
Tested ok on regex101.com with the two events you gave.
Then you can change the "+" to "*" to match 0 or many characters ("+" matches 1 or many):
(?i)&account=(?P
That would produce: account=""
If you wanted it to be "-", then you can use this eval:
In search:
| eval account=if(isNull(account),"-",account)
In props.conf:
EVAL-account = if(isNull(account),"-",account)
One question some times it has no value in it. as shown below. i was expecting something like - in the captured values. if i want to capture that as well, can i do that?
?product=%20FILTERS%2016z20r2&account=&country=US HTTP/1.1" 200 3388 218391
Thank you. It worked.