topic Re: Need Regex for a field extraction in Getting Data In

Help with Regex for a field extraction?

sekhar463 — Wed, 01 Mar 2023 18:26:11 GMT

hai all,

need help on regex to extract Major as new field with message whatever after Major

Major SIPCM *SipCmRecvFromTcpSocket: Error in reading data on socketId 247, errno=104

Major NRS ARP lookup for 216.20.237.19 on interface pkt0 with addrContextId 1 failed: SIOGARP error , error 6

Major LVM *NpMediaYmacRespHdlr: error code 0x3 recvd for bcm cmd 4

Re: Need Regex for a field extraction

gcusello — Wed, 01 Mar 2023 15:46:01 GMT

Hi @sekhar463,

let me understand:

you want to extract the word after Major (SIPCM, NRS and LVM) in a field called "Major" and the string after these values to the end as "message" field, is it correct?

if this is your need, please try this regex:

| rex "^Major\s+(?<major>\w+)\s+(?<message>.*)"

that you can test at https://regex101.com/r/HBKc52/1

Ciao.

Giuseppe

Re: Need Regex for a field extraction

sekhar463 — Wed, 01 Mar 2023 15:59:17 GMT

Want to extract all message after Major and keep in a new fields as Major

Re: Need Regex for a field extraction

gcusello — Wed, 01 Mar 2023 16:06:17 GMT

Hi @sekhar463,

ok, all after Major in a field called "Major", please try this:

| rex "^Major\s+(?<Major>.*)"

that you can test at https://regex101.com/r/HBKc52/2

Ciao.

Giuseppe