how to extract below fields from raw logs

[aditsss]

][ERROR][pub-#32738][AssociationRemoteProcessor] Exception while running association: javax.cache.CacheException: class org.apache.ignite.IgniteInterrup

[2023-11-09T06:06:02,015][ERROR][pub-#19230][FedPledgingFlaggingRemoteProcessor] No rejection criteria found for the specified key: CO.

Hi ,

Can anyone guide me how to extract the highlighted text.

[inventsekar]

Hi @aditsss ... if any reply solved your query, could you pls accept it as a solution.. 

karma points / upvotes are appreciated, thanks. 

[gcusello]

Hi @aditsss ,

please try this regex:

| rex ".*\]\s*(?<msg>[^:]+)"

that you can test at https://regex101.com/r/7yLHPr/1

Ciao.

Giuseppe 

[inventsekar]

Hi @aditsss 

Please check this:

| makeresults
| eval _raw="[AssociationRemoteProcessor] Exception while running association: javax"
| rex field=_raw "\]\s(?<rexField>.*)\:"
| table _raw rexField

this rex produces this output:

_raw rexField

[AssociationRemoteProcessor] Exception while running association: javax

Exception while running association

[richgalloway]

It would help to know what you've tried so far, but perhaps this will help.

| rex "] (?<field>.*?):"