Extract a field

[vineela]

I have few events whereas few events are configured as keyvalue pairs and few are not. when i am using search time extractions it is not taking.

Example event : 09/Jun/2021:15:45:12 +1000 [DefaultJmsListenerContainer-1] [correlationId=] ERROR au.com.commbank.pso.payments.pds.listener.util.JmsInExceptionListener - Wed Jun 09 05:45:12 UTC 2021,,,,,PDS Event Microservice Listener,,PDS_ERR_EVENT_MICROSERVICE_0003,PDS Event Microservice connection to MQ has failed,,,,,,,,,,,,

09/Jun/2021:15:45:02 +1000 [DefaultJmsListenerContainer-1] [correlationId=] ERROR au.com.commbank.pso.payments.pds.listener.util.JmsInExceptionListener - Wed Jun 09 05:45:02 UTC 2021,,,,,PDS Event Microservice Listener,,PDS_ERR_EVENT_MICROSERVICE_0003,PDS Event Microservice connection to MQ has failed,,,,,,,,,,,,

I need to extract only "PDS_ERR_EVENT_MICROSERVICE_0003" as errorcode and "PDS Event Microservice connection to MQ has failed" as errorMessage .

Can anyone help me with either regex or any other way to extract only these values.

Because i need to chart values and create alert based on this.

Thanks in Advance

[ITWhisperer · Accepted solution]

| rex "([^,]*,){7}(?<errorcode>[^,]*),(?<errormessage>[^,]*),"

[vineela]

Yes, That worked perfectly. Thanks for the quick response