One field extract should work, especially if your logs all lead with 'error' string prefix. Simple extraction based on your sample events:
(?i)error[\s:]+(?.*) OR (?i)error[^\w]+(?.*(?\]|\.))
The first one being the more simple/straightforward of the two, with the latter aiming to clean up the extracted data if you are so inclined.
perl -ne 'print $1.$/ if /error[^\w]+(.*(?<!\]|\.))/i' re_sample
exceed max iterations, iter 120, count_trial 120
setup_acap_venv.sh failed
ac_analysis.tools.merge_annotations:327
Joe
... View more