Extract a field

vineela — Wed, 09 Jun 2021 06:50:53 GMT

I have few events whereas few events are configured as keyvalue pairs and few are not. when i am using search time extractions it is not taking.

Example event : 09/Jun/2021:15:45:12 +1000 [DefaultJmsListenerContainer-1] [correlationId=] ERROR au.com.commbank.pso.payments.pds.listener.util.JmsInExceptionListener - Wed Jun 09 05:45:12 UTC 2021,,,,,PDS Event Microservice Listener,,PDS_ERR_EVENT_MICROSERVICE_0003,PDS Event Microservice connection to MQ has failed,,,,,,,,,,,,

09/Jun/2021:15:45:02 +1000 [DefaultJmsListenerContainer-1] [correlationId=] ERROR au.com.commbank.pso.payments.pds.listener.util.JmsInExceptionListener - Wed Jun 09 05:45:02 UTC 2021,,,,,PDS Event Microservice Listener,,PDS_ERR_EVENT_MICROSERVICE_0003,PDS Event Microservice connection to MQ has failed,,,,,,,,,,,,

I need to extract only "PDS_ERR_EVENT_MICROSERVICE_0003" as errorcode and "PDS Event Microservice connection to MQ has failed" as errorMessage .

Can anyone help me with either regex or any other way to extract only these values.

Because i need to chart values and create alert based on this.

Thanks in Advance

Re: Extract a field

ITWhisperer — Wed, 09 Jun 2021 08:56:14 GMT

| rex "([^,]*,){7}(?<errorcode>[^,]*),(?<errormessage>[^,]*),"

Re: Extract a field

vineela — Wed, 09 Jun 2021 09:41:41 GMT

Yes, That worked perfectly. Thanks for the quick response

topic Re: Extract a field in Alerting

Extract a field

Re: Extract a field

Re: Extract a field