Problem Extract Field

[amielke]

Hi,

will extract the from the following Strings the http Code like 200 or 404:

[03/Jun/2014:01:59:53 +0200] "HEAD /index.html HTTP/1.1" 200 - "-" "-"

[27/Jun/2014:15:20:11 +0200] "GET /index.html HTTP/1.0" 200 6130 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.0; "xxxx")"

[27/Jun/2014:15:21:00 +0200] "GET /wp-login.php HTTP/1.0" 404 195 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/24.0.1290.1 Safari/537.13"

But if I select the 200 or 404 via the Fieldextraction in 95% works fine, but not at the first line. The only difference is only HEAD and not GET.
Some ideas to fix the problem?

[MuS]

Hi amielke,

you have two spaces after HEAD therefore it will propablly not match, try something like this:

your base search | rex field="_raw" "\"\s(?<myStatus>\d+)\s" | table myStatus

cheers, MuS