Hello All,
I have the below string
2020-04-24 23:14:47,422 INFO http-8080-1 com.pscu.dxsimple.raApp - Response (Success:true)-(Validation:true)-(F_TAG:1402)-(CLIENT_ID:2113)-(Total_TT:4046ms)-(AppServer_TT:3419ms)
I need to extract the key value pairs that are "(Success:true)-(Validation:true)-(F_TAG:1402)-(CLIENT_ID:2113)-(Total_TT:4046ms)-(AppServer_TT:3419ms)" as specific fields.
I used index=testindex source="tomcat.txt"| extract pairdelim="\"{-}" kvdelim=":"
I am able to see the keyvalue being generated but i need to have this data persistant and saved permanently. How can i do this?
Please help
You can use inline field extraction. Add below configuration in props.conf. Fields are extracted whenever you search source=tomcat.txt
. You can also use a sourcetype
name in place of source
name.
props.conf
[tomcat.txt]
EXTRACT-myfields = \(Success:(?<Success>\w+)\)-\(Validation:(?<Validation>\w+)\)-\(F_TAG:(?<F_TAG>\w+)\)-\(CLIENT_ID:(?<CLIENT_ID>\w+)\)-\(Total_TT:(?<Total_TT>\w+)\)-\(AppServer_TT:(?<AppServer_TT>\w+)\)