Backreferences in Fieldnames of rex

[SaltyHash123]

Hey There,

i have n Systems.

I would like to apply a rex query, where each fieldname contains the system ID which i have to extract from the logs too.

Example:

... | rex field=_raw "System(\d+)\sFailure\sRate\s(?<system_\1_failurerate>\d*)"

Unfortunately backreferencing for field name seems not to be supported.

Has anyone an idea? It needs to be added in a TA afterwards, hence eval etc. are not applicable 

Thanks 🙂

[SaltyHash123]

It works but i forgot to mention, that each log can have multiple matches. This solution will only find the first match in the logs

[ITWhisperer]

Perhaps if you could share an anonymised example log entry or two - please use code block </> to share it

[SaltyHash123]

SystemR1 Failure Rate 17
System2 Failure Rate 3

I held the whole example abstract as i can't even share anonymized data 😕 

making a rex like the following one will match the first row with system R1 but ignore system 2

| rex field=_raw "System(?<id>R?\d)\sFailure\sRate\s(?<rate>\d+)
| eval system_{id}_failure = rate

using multivalues is also not possible, as this will be used as a transform in a globally available TA

[ITWhisperer · Accepted solution]

How about modifying the text into xml and extracting the fields that way

| makeresults
| eval _raw="SystemR1 Failure Rate 17
System2 Failure Rate 3"
| rex mode=sed "s/(?<system>System.+\sFailure\sRate) (?<rate>\d+)/<\1>\2<\/\1>/g s/\s+/_/g"
| spath

[ITWhisperer]

| rex field=_raw "System(?<number>\d+)\sFailure\sRate\s(?<system_failurerate>\d*)"
| eval system_{number}_failurerate=system_failurerate