topic Re: regex in Getting Data In

regex

pavanbmishra — Tue, 23 Nov 2021 14:27:08 GMT

what should the best regex to catch it up these 3 diff fields

-ec-1
-ec-01
-ec01

gcusello — Tue, 23 Nov 2021 14:31:59 GMT

could you share a sample of your logs to be more sure?

Anyway, if these are the strings to extract as field, you could use:

| rex "(?<your-field>ex[^ ]+)"

But, please share your logs.

ciao.

Giuseppe

pavanbmishra — Tue, 23 Nov 2021 15:58:12 GMT

We have host field ending with these strings ( -ec-1/-ec-01/-ec01)have to be captured through regex.

abc-ec-1
xyz-ec-01
pqr-ec01

gcusello — Tue, 23 Nov 2021 16:05:54 GMT

please try this

\w+-(?<your_field>.*)

Ciao.

Giuseppe