Hi ,
My log consists of below
msg: 2018-07-07 14:30:02.226 INFO 7 --- [nio-8080-exec-6] c.f.p.a.service.CGEventRetimeService : <
I need to extract the values after <> : i.e) 12006 alone and create alert to be sent to user .
How do I do it ?
Two options:
| rex "\<\>\s+:\s+(?<field1>\d+)"
https://regex101.com/r/0na0Fq/1| rex "(?<field1>\d+)$"
https://regex101.com/r/0na0Fq/2Note that second option is a simpler regex, but less efficient.
This should work:
| rex "\<\>\s\:\s(?<NUMBERS>\d+)"
Let us know if you need more help.
To be more precise - i need to search for msg with " Invalid Retimed Control Group " text and extract the highlighted felds
msg: 2018-07-07 14:30:02.226 INFO 7 --- [nio-8080-exec-6] c.f.p.a.service.CGEventRetimeService : < Invalid Retimed Control Group > : CCF 2018 12006
and display the highlighted bold once as separate columns in CSV file as below
Date - 2018-07-07
Time - 14:30:02
PTVL - CCF
MY - 2018
CG - 12006
give this a shot:
| rex "^msg\:\s(?<DATE>.[^\s]+)\s(?<TIME>.[^\s]+).[^\:]+\:.[^\:]+\:\s(?<PTVL>.[^\s]+)\s(?<MY>.[^\s]+)\s(?<CG>.[^\s]+)"
You will want to do
| table DATE TIME PTVL MY CG