topic Re: How to extract message from log events. in Splunk Search

How to extract message from log events.

avi7326 — Wed, 19 Jul 2023 09:00:36 GMT

I want to extract the message that is 'until-successful' retries exhausted from the below logs.
And also a second rex query to extract both message and element and get in the table.
Any Help will be appreciated.

{ [-]
logger: org.mule.runtime.core.internal.exception.OnErrorPropagateHandler
message:

********************************************************************************

Message : 'until-successful' retries exhausted

Element : bmw-sl-nsp-case-readSub_Flow/processors/1 @ bmw-sl-nsp-prd-api:write/bmw-sl-nsp-case-read.xml:88 (Until Successful)

Element DSL : <until-successful maxRetries="${max.retries}" doc:name="Until Successful" doc:id="b76dd101-8752-43aa-ab94-d548b699ea7a" millisBetweenRetries="${time.between.retires.case}"> <http:request method="GET" doc:name="Get Cases" doc:id="b846734d-4ff0-479d-bc21-e112cd9e8919" config-ref="HTTP_Request_configuration" path="${schedular.getcases.target.path}" sendCorrelationId="ALWAYS" correlationId="#[correlationId]"> <http:query-params><![CDATA[ #[output application/java --- { "startTimestamp" : vars.startTimestamp, "country" : vars.currentCountry, "endTimestamp" : vars.endTimestamp, "businessUnit" : vars.currentBusinessUnit }]

Re: How to extract message from log events.

gcusello — Wed, 19 Jul 2023 09:24:30 GMT

Hi @avi7326,

this seems to be a json log, so you can use "INDEXED_EXTRACTIONS =json" at the ingestion or the "spath" command during the search.

Anyway, you can extract this string also using a regex like the following:

| rex "Message\s+:\s+(?<message>.+)"

that you can test at https://regex101.com/r/OhTHyC/1

ciao.

Giuseppe

Re: How to extract message from log events.

avi7326 — Wed, 19 Jul 2023 09:35:15 GMT

I have tried the above query but from that I am getting the whole message I only want to extract the 1 and 2 line .
I have tried this and getting only until successful in the table I want the whole line 'until-successful' retries exhausted
| rex field=message "(?ms)Message\s+'(?<message>.*?)'"
| table message

Re: How to extract message from log events.

avi7326 — Wed, 19 Jul 2023 09:56:51 GMT

Re: How to extract message from log events.

gcusello — Wed, 19 Jul 2023 13:04:23 GMT

Hi @avi7326,

let me understand: you want to extract only the logger and message rows in two different fields, is it correct?

in this case, please try this regex

| rex "(?ms)logger:(?<logger>.*)\s*message:\s+(?<message>.*)Message"

that you can test at https://regex101.com/r/OhTHyC/2

Ciao.

Giuseppe