Resource_list_select=ncpus=24:mpiprocs=2:node_class=n24.48+7:ncpus=24:mpiprocs=1:node_class=n24.48
Every once in a while I get an event when there was a problem with an application that this fields data gets duplicate fields appended.
The pieces I'm wanting to pull out of this into individual fields are node_class and ncpu's, but whenever there was an unexpected problem it appends a +with a number and repeats the field.
The rex I've been working on is: ..| rex field=Resource_List_select "\d:node_class=(?.*\d.[0-9]\d)" This grabs the first instance of node_class or ncpu respectively but when there is duplicate entries in the field for each nested field, thats where it gets confused.
How could I revise this regex to grab node_class=n##.## and stop before it gets to a + sign? whenever the data is formatted correctly the delimiter would be the :
