need to extract these errors from our logs

[sphiwee]

Can i get the following words that are bold extracted

1.  [ERROR] org.openqa.selenium.TimeoutException

2020-10-16 13:11:42 [machine-run-555555-hit-1087581-step-555] TSXLogAttachmentRobot [ERROR] org.openqa.selenium.TimeoutException: Expected condition failed: waiting for number of open windows to be 2 (tried for 30 second(s) with 500 MILLISECONDS interval)

2. Frzzz Logs Business Process v2.0.7 (TTTxLogAttachment)

Capabilities [{capabilityNodeId=http://127.0.0.1:5000, extra.executor.id={run.name=[Digiminds - FraudLogs] Part 2 v.2.0.7, task.uuid=c65b1153-bd19-4c32-b186-26ae21ca237b, task.name=Frzzz Logs Business Process v2.0.7 (TTTxLogAttachment),

3. the word [INFO]

2020-10-16 15:37:17 [bp-[25cf86e3]-completeMachineRun-569576] HitService [INFO] Snapshot creation for Run: id=569576, uuid=d60be317-fcaa-4d96-89f5-8144216bdd28 name=Debt Structure Project v2.0.22 (MainframeCpsRobot) {size:1, status:COMPLETED, rootRun:25cf86e3-2b33-4ee6-85b0-a303cb612efc, data:} was skipped due to snapshot generation preferences or it is final step

4. the word [DEBUG]

2020-10-16 15:28:00 [TTTTTTTTTT_Worker-44] HitService [DEBUG] Step description for run 20cda5dd-3081-4660-be90-f2103c52a716 from campaign c701b1b7-96f3-46b6-a408-61b18d066e45 is null

[gcusello]

Hi @sphiwee,

when you say "Can i get the following words", are you meaning that you want to filter events and find the ones containing these strings or put these values in a field?

if you want only to filter events and find the ones containing these strings, you can run a simple search like this:

your_search ("[ERROR] org.openqa.selenium.TimeoutException" OR "Frzzz Logs Business Process v2.0.7 (TTTxLogAttachment)" OR "[INFO]" OR "[DEBUG]")
| ...

If the strings to search are many, you could put them in a lookup (called e.g. patterns.csv) containing one column called e.g. "pattern" and run a search like this:

your_search [ | inputlookup patterns.csv | rename pattern AS query | fields query ]
| ...

Ifg instead you want to put these strings in a field you have to create a regex for each string, something like this:

your_search 
| rex "(?<pattern>(\[ERROR\] org\.openqa\.selenium\.TimeoutException)|(Frzzz Logs Business Process v2\.0\.7 \(TTTxLogAttachment\))|(\[INFO\])|(\[DEBUG\]))"
| search pattern=*
| table _time pattern

Ciao.

Giuseppe

[sphiwee]

Yes, i'm struggling with writing regular expressions for those words