I have a log in tomcat as -
... [MerchantEndPoint]: saveMerchantDetails():ednpoint execution enterd
..
... [CreditEndPoint]: saveCreditDetails():ednpoint execution enterd
-..
I want to create a chart based on the entry logs how many times service getting called /day
i have created a regex with below query but its not giving correct result, in regex editor it works fine
index=fg_wv_li | sourcetype="fg:mylogs.txt" ":endpoint execution started" | rex field=_raw "\b(?<stype>(\[]a-zA-Z]+\][:]))" | chart count by stype
i want as servicename:method name : count / day
[MerchantEndPoint]: saveMerchantDetails(): 10
[CreditEndPoint]: saveCreditDetails() : 15
Can someone help me to fix the query above?
Thanks.
Try
|rex field=_raw "(?<stype>\[\w+\]:\s+\w+\(.*\))"
Thanks. It worked.