Here is my event log sample below
[LOG LEVEL=INFO] [LOGGER=WIFI_ACCESS_INFO] [INTERFACE ID=WIFI_ACCESS] [STEP=START] [RUN_ID=20200426140325679] [Message=Call received for PID: 1234 ]
Actually i don't need this event, so I would like filter out this event based on the Message but it is not working as Message has phrase. Please let me know how to filter out this event. Thanks for your help in advance.
Hello @nsudha1975,
there are several options, two of them are:
| regex _raw!="\[Message=Call received for PID"
and
NOT "Message=Call received for PID"
if you want to extract the field Message in full try this:
| rex "\[Message=(?<Message>[^\]]+)\]"
Let me know how it went