Custom Regex

[vishwa]

Below is the regex used, here we want to extract following fields:
DIM
TID
APPLICATION
POSITION
CORRLATIONID

The rex which i used is extraction DIM, TDI, APPLICATION as one field, but we need them separately.
We need to write the rex generic so that it should capture the data if there are different field names as well

[PickleRick]

UGH. If you have any say in this - try to force the team responsible for producing these logs to get them in some reasonable format. It's some mix of pseudo-syslog embedded in some pseudo-json, and containing some "kinda delimited key/value pairs". It's not gonna end well.

[scelikok]

Hi @vishwa,

You can use below regex;

([A-Z]+)\:\s+(.+?)\s+

[SierraX]

With this kind and quality of screenshot it's very hard to help.
Take a look to Fields in settings and there especially for Field extractions and Field transformations

[ITWhisperer]

You could try something like this

ITWhisperer_0-1712856948472.png

[vishwa]

Hi @ITWhisperer , 

Actually I need the generic rex like the way I posted in the screen shot because this is given in transforms.conf file and i tried the query u provided it's not working