Capturing specific string from log using regex

[freephoneid]

Hi,

I've below log lines in below format:

[2011-09-30 23:33:20:465 GMT+00:00][F3951B38F4DF45440927EDF522D5C9FF.http-8080-3][com.abc.xyz.MyWrapper] DEBUG alive?=false native?=true vision?true

How can I get the values of alive, native & vision variables? Please note that after vision?, there is no "=" sign. Log is not consistent. I also want to count how many of them are with alive &whats the count for native & vision...

Appreciate your help!

Thanks!

[Ayn · Accepted solution]

Is your question regarding a regex for this specific log event? If so, this one should do it:

| rex "DEBUG alive\?=(?<alive>\S+)\s+native\?=(?<native>\S+)\s+vision\?(?<vision>\S+)"

[Ayn]

field=_raw is used implicitly unless you specify anything else. Sometimes you might want to use another field for rex to operate on, but most commonly you'll extract fields from the raw event data. field=_raw can be used to show more explicitly that you're operating on the raw field, but really there is no functional reason for including it.

[freephoneid]

When do we use rex field=_raw ??...You didn't use it here...Just wondering...