what should the best regex to catch it up these 3 diff fields
-ec-1-ec-01-ec01
We have host field ending with these strings ( -ec-1/-ec-01/-ec01)have to be captured through regex.
abc-ec-1xyz-ec-01pqr-ec01
Hi @pavanbmishra,
please try this
\w+-(?<your_field>.*)
that you can test at https://regex101.com/r/ujVKV6/1
Ciao.
Giuseppe
could you share a sample of your logs to be more sure?
Anyway, if these are the strings to extract as field, you could use:
| rex "(?<your-field>ex[^ ]+)"
But, please share your logs.
ciao.
