Hi Everyone,
How can I extract the highlighted field from raw logs:
ARC EVENT RECEIVED FROM SOURCE ,RoutingPath:blaze-team_e-dmrupload
ARC EVENT RECEIVED FROM SOURCE ,RoutingPath:blaze-team_g
ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF ,RoutingPath:blaze-team_e-dmrupload, Body:null
ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF ,RoutingPath:blaze-team_g ,Body:{
Thanks in advance
The rex command can extract that field quite easily provided a rule can be written for the field. What is the format of a valid RoutingPath name? Is it always "blaze-team_" followed by a letter?
its not always blaze team it could be mf ,of-gsn like this also.
How can we make a general regex.
Rex (regex) is looking for a pattern - you should work out what pattern of letters, numbers, spaces and punctuation you are looking for; this is for both the anchor and the match. Your anchor appears to be "RoutingPath:", but the question is what is the match pattern? For example, "word-word_letter" (blaze-team_g), "word_letter" (mf_a), "word-word_word" (of-gsm_xyz). In the rex expression word would be replaced by \w+, - replaced by \- and letter by \w for example, giving "\w+\-\w+_\w", "\w+_\w", and "\w+\-\w+_\w+" respectively.
Can you please provide me the regex.
Currently my logs are like this:
ARC EVENT RECEIVED FROM SOURCE ,RoutingPath:blaze-team_e-dmrupload
ARC EVENT RECEIVED FROM SOURCE ,RoutingPath:blaze-team_g
ARC EVENT RECEIVED FROM SOURCE ,RoutingPath:blaze-team_b-ivurtupload
ARC EVENT RECEIVED FROM SOURCE ,RoutingPath:mf-gsn-ivurtupload
RoutingPath:(?<team>\w+\-\w+)
Hi @aditsss,
to take al the condition you need you have to use two regexes and collapse results using eval, something like this:
| rex "RoutingPath:(?<RoutingPath1>[^-]*-[^-\n]*)(\-\w+)"
| rex "RoutingPath:(?<RoutingPath2>[^-]*-[^-\n]*)\n"
| eval RoutingPath=coalesce(RoutingPath1,RoutingPath2)
Ciao.
Giuseppe