topic Re: Pull a field through regex in Getting Data In

Pull a field through regex

Nidd — Fri, 15 Jan 2021 10:30:31 GMT

I have the following log:

Number=Test1,Code=DPCA , ErrorMessage= sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I'm trying to pull ErrorMessage from the log through regex but in vain. The field is not getting extracted. Below is the regex I'm using. Am I missing something? Please help.

rex "^(?:(?<ErrorMessage>[^,]*),){3}"

Re: Pull a field through regex

gcusello — Fri, 15 Jan 2021 10:54:39 GMT

Hi @Nidd,

let me understand: what's the ErrorMessage you're serching for:

all after "ErrorMessage=",
all until ":" one time,
all until ":" many times.

In the first case the regex it's easy:

ErrorMessage\=\s+(?<ErrorMessage>.*)

and you can test it at https://regex101.com/r/7hAGRj/1

The second is similat to your:

ErrorMessage\=\s+(?<ErrorMessage>[^:]*)

and you can test it at https://regex101.com/r/7hAGRj/2

the third requires two extractions:

| rex "ErrorMessage\=\s+(?<FullErrorMessage>.*)" | rex field=FullErrorMessage "(?<ErrorMessage>[^:$]*)(:|$)"

Ciao.

Giuseppe

Re: Pull a field through regex

Nidd — Fri, 15 Jan 2021 11:12:17 GMT

Thank you very much @gcusello ! That worked ! 🙂