index=abc ns=sigh nodeException node="*" Id=* |rex "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|fields datetime
You don't need field= as the default field is _raw - if you want to specify it explicitly then use
index=abc ns=sigh nodeException node="*" Id=* |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|fields datetime
This regex will extract the datetime
"message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"
I tried like below . Not able to get any result
Where I am going wrong!
index=abc ns=sigh nodeException node="*" Id=* |rex field="message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|fields datetime
Ideally, this extract should be done at indexing time
index=abc ns=sigh nodeException node="*" Id=* |rex "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|fields datetime
You don't need field= as the default field is _raw - if you want to specify it explicitly then use
index=abc ns=sigh nodeException node="*" Id=* |rex field=_raw "message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|fields datetime