topic Extract a string from an existing field value in Getting Data In

Extract a string from an existing field value

avkchare — Thu, 03 Dec 2020 17:02:26 GMT

Hi guys,

I have the following event:

[DefaultMessageHistory[routeId=Receive, node=to618]], CamelToEndpoint=log://nl.vvv.kip.interfaces.timetellinboundtimecards.Receive?level=INFO&multiline=true&showAll=true&style=Fixed} Headers {breadcrumbId=ID-localhost-2206437765421-19-3, CamelFileAbsolute=true, CamelFileAbsolutePath=/data/bamba/Simebards

What I need is a regular expression to extract the word timetellinboundtimecards and I want to rename it service-name.

Furthermore, i need another regular expression to extract the word Receive (or Request or send or Failed) and rename it to status.

Please let me know if you have the solution for this problem.

Kind regards,

K.C.

Re: Extract a string from an existing field value

richgalloway — Thu, 03 Dec 2020 19:40:03 GMT

What have you tried so far?

Re: Extract a string from an existing field value

avkchare — Fri, 04 Dec 2020 08:22:33 GMT

Hi Richgalloway,

To extract the word timetellinboundtimecards I used the following search query:

index=vip-ota Logger=nl.vvv.kip.interfaces.TimetellInboundTimecards.*
| rex "CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>.*)+\?level"
| table _time, serviceName

Kind Regards,

K.C.

Re: Extract a string from an existing field value

richgalloway — Fri, 04 Dec 2020 14:06:31 GMT

Your regex was close. This one worked for me with your sample event.

CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>[^\.]+)\.(?<status>[^\?]+)\?

Are you familiar with the web site regex101.com for testing regular expressions?