I got a requirement to extract " response_time: " field value from all logs and display table with name cf_rt I tried creating new field but its not returning data from all matching case. please advise.
Log format:
response_time:0.091901 gorouter_time:0.000400 app_id:"038e332a-4423-426b-9693-2488eafcd37d"
Hi
Give a try with this rex
| makeresults
| eval _raw="x_forwarded_proto:\"https\" vcap_request_id:\"2978162c-8dcc-47cb-ad10- e73187c36896\" response_time:1.833375 gorouter_time:0.000280 app_id:\"fd22e808-539c-4003-b221-cdc42aa03dbb\" app_index:\"0\" x_b3_traceid:\"12474aa9e6d47857\" x_b3_spanid:\"d3745ed0d25bd8d3\" x_b3_parentspanid:\"12474aa9e6d47857\" b3:\"12474aa9e6d47857- d3745ed0d25bd8d3-1-12474aa9e6d47857\" "
| rex "response_time:(?P<response_time>\S+)"
your search
| raname msg as _raw
| extract pairdelim=" " kvdelim=":"
| rename response_time as cf_rt
how can we display yellow highlighted key value from all events in to table
I see, my answer is updated.
thanks i am able to pull the data but not able to rename the _raw column it should be renamed as msg when i did that my response time values are not showing in table.
I'm not sure, please use a regular expression.