Field Extraction

[sahana]

Hi

I have requirement to fetch the some value like asf55-hsgf-56bj4b-rdhh-5b4f, this values are sent from the applications in two different ways like 

1)message: dhgfsjd{endbjjdfg, country=hongkong, server=gvfhsd, idVal=asf55-hsgf-56bj4b-rdhh-5b4f, error=gvrf hdfhdsf, errorCode=47574}

The another format is

2)message: dhgfsjd{endbjjdfg, country=[hongkong], server=[gvfhsd], idVal=[asf55-hsgf-56bj4b-rdhh-5b4f], error=[gvrf hdfhdsf], errorCode=[47574]}

I was suppose to extract the idval value which should satisfy the above case.

I have tried with below rex command,

|rex field = message "(idVal={1}(?P<ppid>.+?,))" | eval value =split(ppid,",")

output :asf55-hsgf-56bj4b-rdhh-5b4f

the above command is working fine for first case alone but we have the logs with second case it returns output as [asf55-hsgf-56bj4b-rdhh-5b4f]

[isoutamo]

Hi

you can replace your rex string to this and remove last eval at the same time

| rex field=message "idVal=\[?(?P<ppid>.+?)\]?,"

r. Ismo