Hello everyone,
I have the following pattern of logs and I'm trying to use rex to filter the values, but I'm having problems because of + in some events, can you help me?
| rex field=_raw "DNIS:(?<ANI>\d+)"
2020-09-25 11:50:52.946-03:00
DNIS:+558730246133
2020-09-25 11:51:33.218-03:00
DNIS:994699160
2020-09-25 11:52:52.946-03:00
DNIS:994376160
2020-09-25 11:53:52.946-03:00
DNIS:+994699160
2020-09-25 11:54:52.946-03:00
DNIS:+558730246133
| rex field=_raw "DNIS:\+(?<ANI>\d+)"
If you want to include the + in the field then try
| rex "DNIS:(?<ANI>\+?\d+)"
If you don't want the + in the field then try this
| rex "DNIS:\+?(?<ANI>\d+)"