topic Re: extract characters after colon in Alerting

extract characters after colon

ksharany — Mon, 09 Jul 2018 10:20:12 GMT

Hi ,

My log consists of below

msg: 2018-07-07 14:30:02.226 INFO 7 --- [nio-8080-exec-6] c.f.p.a.service.CGEventRetimeService : <> : 12006

I need to extract the values after <> : i.e) 12006 alone and create alert to be sent to user .

How do I do it ?

Re: extract characters after colon

jodyfsu — Mon, 09 Jul 2018 12:49:29 GMT

This should work:

| rex "\<\>\s\:\s(?<NUMBERS>\d+)"

Let us know if you need more help.

Re: extract characters after colon

FrankVl — Mon, 09 Jul 2018 12:53:15 GMT

Two options:

use the characters in front of it as demarkation point: | rex "\<\>\s+:\s+(?<field1>\d+)" https://regex101.com/r/0na0Fq/1
if it is really at the end of the event and you don't have other (similar) logs that cause issues, you can grab if from the end of the string: | rex "(?<field1>\d+)$" https://regex101.com/r/0na0Fq/2

Note that second option is a simpler regex, but less efficient.

Re: extract characters after colon

ksharany — Tue, 10 Jul 2018 14:31:39 GMT

To be more precise - i need to search for msg with " Invalid Retimed Control Group " text and extract the highlighted felds

msg: 2018-07-07 14:30:02.226 INFO 7 --- [nio-8080-exec-6] c.f.p.a.service.CGEventRetimeService : < Invalid Retimed Control Group > : CCF 2018 12006

and display the highlighted bold once as separate columns in CSV file as below

Date - 2018-07-07
Time - 14:30:02
PTVL - CCF
MY - 2018
CG - 12006

Re: extract characters after colon

jodyfsu — Tue, 10 Jul 2018 14:48:33 GMT

give this a shot:

| rex "^msg\:\s(?<DATE>.[^\s]+)\s(?<TIME>.[^\s]+).[^\:]+\:.[^\:]+\:\s(?<PTVL>.[^\s]+)\s(?<MY>.[^\s]+)\s(?<CG>.[^\s]+)"

Re: extract characters after colon

jodyfsu — Tue, 10 Jul 2018 14:49:56 GMT

You will want to do
| table DATE TIME PTVL MY CG

Re: extract characters after colon

PowerPacked — Tue, 10 Jul 2018 16:42:47 GMT

Hi @ksharany

Take a look at this.

Thanks