How to ignore some rex data?

[albyva]

Using the extract tool, I'm trying to build a field on the "has reached XXXX" number from a Cisco log using the following rex example: | rex "(?i) has reached (?P[^,]+)"

%ROUTING-BGP-5-MAXPFX : No. of IPv4 Unicast prefixes received from 1.2.3.4 has reached 10622, max 14000

It works great, except it's pulling in data I don't want from a similar set of data listed below:

%ENV_MON-2-FAN: Fan array has reached CRITICAL level.

How do I ignore the "CRITICAL level" and only report the number of prefixes? Overall I want something like (NOT "Fan array has reached"), but that obviously doesn't work in rex.

Thanks,

[lukejadamec · Accepted solution]

Try this:
| rex "(?i) has reached (?P<fieldname>\W[^,]+)"
This assumes that you're only interested in numbers - \W means not a letter.

[albyva]

The \d did it. Thanks.

| rex "(?i) has reached (?P<FIELDNAME>\d[^,]+)"

[somesoni2]

I guess it should be "\d" to capture just the digits. "\W" didn't work for me.