Extract a string from an existing field value

[avkchare]

Hi guys,

I have the following event:

[DefaultMessageHistory[routeId=Receive, node=to618]], CamelToEndpoint=log://nl.vvv.kip.interfaces.timetellinboundtimecards.Receive?level=INFO&multiline=true&showAll=true&style=Fixed} Headers {breadcrumbId=ID-localhost-2206437765421-19-3, CamelFileAbsolute=true, CamelFileAbsolutePath=/data/bamba/Simebards

What I need is a regular expression to extract the word timetellinboundtimecards and I want to rename it service-name.

Furthermore, i need another regular expression to extract the word Receive (or Request or send or Failed)  and rename it to status.

Please let me know if you have the solution for this problem.

Kind regards,

K.C.

[richgalloway]

What have you tried so far?

[avkchare]

Hi Richgalloway,

To extract the word timetellinboundtimecards I used the following search query:

index=vip-ota Logger=nl.vvv.kip.interfaces.TimetellInboundTimecards.*
| rex "CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>.*)+\?level"
| table _time, serviceName

Kind Regards,

K.C.

[richgalloway]

Your regex was close.  This one worked for me with your sample event.

CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>[^\.]+)\.(?<status>[^\?]+)\?

Are you familiar with the web site regex101.com for testing regular expressions?