Pull a field through regex

[Nidd]

I have the following log:

Number=Test1,Code=DPCA , ErrorMessage= sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I'm trying to pull ErrorMessage from the log through regex but in vain. The field is not getting extracted. Below is the regex I'm using. Am I missing something? Please help.

rex "^(?:(?<ErrorMessage>[^,]*),){3}"

[gcusello · Accepted solution]

Hi @Nidd,

let me understand: what's the ErrorMessage you're serching for:

• all after "ErrorMessage=",
• all until ":" one time,
• all until ":" many times.

In the first case the regex it's easy:

ErrorMessage\=\s+(?<ErrorMessage>.*)

and you can test it at https://regex101.com/r/7hAGRj/1

The second is similat to your:

ErrorMessage\=\s+(?<ErrorMessage>[^:]*)

and you can test it at https://regex101.com/r/7hAGRj/2

the third requires two extractions:

| rex "ErrorMessage\=\s+(?<FullErrorMessage>.*)"
| rex field=FullErrorMessage "(?<ErrorMessage>[^:$]*)(:|$)"

Ciao.

Giuseppe

[Nidd]

Thank you very much @gcusello ! That worked ! 🙂