Extract part of string

[sarit_s]

Hello

I have this source path for example :

AAN831AA_ELS_Log_20200102064858+0000-[PS-MELSPP2]/fsmLog_010220-064856_4C5KKM00_AAN831AA.txt

and i want to extract the part before '-'
 

AAN831AA_ELS_Log_20200102064858+0000

 what should i do ?

thanks

[richgalloway · Accepted solution]

For a search-time extraction, use rex.

| rex "(?<field>[^-]+)"

For an index-time extraction, put this in transforms.conf and reference it in props.conf.

[extractField]
REGEX = (?<field>[^-]+)