How to display the first 3 lines of an event that has triggered an alert?

[omuelle1]

Hi,

I have an alert set up that is triggered by an event that contains almost 100 lines. However, the users are only interested in the first three lines, the rest is noise to them.

Is there a way to only display the first three lines of the event without changing the sourcetype or altering anything in the backend? Like give a regex into the alert that cuts the event off after 3 lines? The lines always end with the same string: "Could not open connection"

I would appreciate some input.

Thank you,

Oliver

[somesoni2]

Give this a try

your current search | rex field=_raw "^(?<trimmed>(.+[\r\n]){3})" | eval _raw=trimmed

[MattZerfas · Accepted solution]

Should be able to do something like this. I know the regex isn't nice and you will probably need to change it for your needs.

... | rex field=_raw "(?<FirstFewLines>(.*\n){3})" | table FirstFewLines

[omuelle1]

Thank you guys, that was what I needed!