I want to extract processid from my log and here is query
eventtype=statustrace | regex _raw="^[IEWF]" | rex field=_raw "(?i)^(?:[^ ]* ){2}(?P
this return following result
I0704 16:04:06.612287 3690 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 14, INPUT
I0704 16:04:06.611132 3690 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 11, NORMAL
47653 I0704 11:14:28.963080 47653 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 11, NORMAL
47653 I0704 11:14:12.682859 47653 logger_c.cpp:42] ThreadData.c:5253 STATUSTRACE: 12, SLEEPING
Why its not return 3690 in first two row?
is something wrong my regular expression?
Yes, there is something wrong with your regex. At least, it didn't match your data. I use an online regular expression tester for testing these sorts of things. Online, you can try: http://www.regextester.com/ - offline, I use an Eclipse plug-in.
Try something like:
rex field=_raw "^[IEWF]\d+ [0-9:\.]+ (?<processid>\d+)"
Yes, there is something wrong with your regex. At least, it didn't match your data. I use an online regular expression tester for testing these sorts of things. Online, you can try: http://www.regextester.com/ - offline, I use an Eclipse plug-in.
Try something like:
rex field=_raw "^[IEWF]\d+ [0-9:\.]+ (?<processid>\d+)"
Thanks for your reply
below regex solved my problem
rex field=_raw "\w+\s\d+:\d+:\d+.\d+\s+(?
Field names are case sensitive, so ensure your extraction matches the field in the table command.
same result with your regex 😞
I have noticed one thing if process id is 5 or more digit then it'll search other wise it'll not