I have the following log:
Number=Test1,Code=DPCA , ErrorMessage= sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I'm trying to pull ErrorMessage from the log through regex but in vain. The field is not getting extracted. Below is the regex I'm using. Am I missing something? Please help.
rex "^(?:(?<ErrorMessage>[^,]*),){3}"
Hi @Nidd,
let me understand: what's the ErrorMessage you're serching for:
In the first case the regex it's easy:
ErrorMessage\=\s+(?<ErrorMessage>.*)
and you can test it at https://regex101.com/r/7hAGRj/1
The second is similat to your:
ErrorMessage\=\s+(?<ErrorMessage>[^:]*)
and you can test it at https://regex101.com/r/7hAGRj/2
the third requires two extractions:
| rex "ErrorMessage\=\s+(?<FullErrorMessage>.*)"
| rex field=FullErrorMessage "(?<ErrorMessage>[^:$]*)(:|$)"
Ciao.
Giuseppe
Hi @Nidd,
let me understand: what's the ErrorMessage you're serching for:
In the first case the regex it's easy:
ErrorMessage\=\s+(?<ErrorMessage>.*)
and you can test it at https://regex101.com/r/7hAGRj/1
The second is similat to your:
ErrorMessage\=\s+(?<ErrorMessage>[^:]*)
and you can test it at https://regex101.com/r/7hAGRj/2
the third requires two extractions:
| rex "ErrorMessage\=\s+(?<FullErrorMessage>.*)"
| rex field=FullErrorMessage "(?<ErrorMessage>[^:$]*)(:|$)"
Ciao.
Giuseppe
Thank you very much @gcusello ! That worked ! 🙂