[02-23 13:55:00] INFO LoggerMessageProcessor [[MuleRuntime].uber.31: [emea-order-mgmt-sys-uat].postOrderMgmtSysFlow.CPU_INTENSIVE @3473fb44]: { "externalTrackingId": "567", "globalTransactionId": "cd535f86-38d4-4f1c-9d1f-e18bc745df21", "muleTransactionId": "c2d3f7f9-1743-4bde-931d-ac59987bb42e", "applicationName": "emea-order-mgmt-sys-uat", "httpMethod": "POST", "processName": "postOrderMgmtSysFlow", "environment": "uat", "src": "dummy_src", "target": "TargetSystemName", "milestoneStatus": "SuccessResponseReturned", "targetResponseTime": 0, "muleProcessingTime": 13}Collapsedate_hour = 13date_mday = 23date_minute = 55date_month = februarydate_second = 0date_wday = thursdaydate_year = 2023date_zone = localhost = http-inputs-olympus-eu.splunkcloud.comindex = mulesoft-emea-dev-demolinecount = 14punct = [-_::]____[[]..:_[----].._@]:_{__"":_"",__"":_"---source = http:mulesoftsourcetype = log4jsplunk_server = idx-i-01f4e4672afe12c83.olympus-eu.splunkcloud.comtimeendpos = 15timestartpos = 1
Use
| rex "environment\"\s?:\s?\"(?<environment>[^\"]*)"
will give you an environment field
Use
| rex "environment\"\s?:\s?\"(?<environment>[^\"]*)"
will give you an environment field
Thanks it worked. can you please help with another field from the same data "muleProcessingTime": 13
That's very similar, but it is not a quoted field, so
| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"
However, it looks like you have JSON object nested inside that raw log message. Are any fields being automatically extracted? Maybe the JSON payload is already there as a field. If not you can do this
| rex ".*?(?<json>\{.*\})"
| spath input=json
which will take everything between the first and last {} and extract all the fields using spath from it. Then all the fields will be extracted to their own field names automatically.
| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"
This one i tried, not capturing the field. have to capture muleProcessingTime from that raw data. based on the captured 2 fields trying to make a chart
This example using your data extracts the muleProcessingTime from that data
| makeresults
| eval _raw="[02-23 13:55:00] INFO LoggerMessageProcessor [[MuleRuntime].uber.31: [emea-order-mgmt-sys-uat].postOrderMgmtSysFlow.CPU_INTENSIVE @3473fb44]: { \"externalTrackingId\": \"567\", \"globalTransactionId\": \"cd535f86-38d4-4f1c-9d1f-e18bc745df21\", \"muleTransactionId\": \"c2d3f7f9-1743-4bde-931d-ac59987bb42e\", \"applicationName\": \"emea-order-mgmt-sys-uat\", \"httpMethod\": \"POST\", \"processName\": \"postOrderMgmtSysFlow\", \"environment\": \"uat\", \"src\": \"dummy_src\", \"target\": \"TargetSystemName\", \"milestoneStatus\": \"SuccessResponseReturned\", \"targetResponseTime\": 0, \"muleProcessingTime\": 13}Collapsedate_hour = 13date_mday = 23date_minute = 55date_month = februarydate_second = 0date_wday = thursdaydate_year = 2023date_zone = localhost = http-inputs-olympus-eu.splunkcloud.comindex = mulesoft-emea-dev-demolinecount = 14punct = [-_::]____[[]..:_[----].._@]:_{__\"\":_\"\",__\"\":_\"---source = http:mulesoftsourcetype = log4jsplunk_server = idx-i-01f4e4672afe12c83.olympus-eu.splunkcloud.comtimeendpos = 15timestartpos = 1"
| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"
so if it is not capturing it in your example, then there is something different with your data. Can you provide an example, for example, so
your search
| head 1
| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"
| table _raw muleProcessingTime
@bowesmana It's capturing but showing an error in regex100 as Your regular expression does not match the subject string.
The quotes around the rex expression are not part of the match, so should not be included in the regex101 expression