Extract String using REGEX

[ashishlal82]

I am fairly new to REGEX and need help with extracting values from the below event
22 Mar 2017 18:41:15,320 WARN SinkRunner-PollingRunner-DefaultSinkProcessor - Using default maxIOWorkers

OUTPUT
Status(field Name) - value(WARN)

[woodcock]

I use this tool:
http://www.regex101.com

Like this:

... | rex "(?<Status>\S+)\s*\["

[alemarzu]

Hi there, try with this.

^[\d\w\s:]+,\d{3}\s(?<STATUS>[A-Z]+)\s\[

OR

,\d{3}\s(?<STATUS>[A-Z]+)(?=\s\[)

[adonio]

you can use the gui field extractor
click an event -> event actions -> extract field -> regular expression -> pick WARN -> name it Status -> verify -> save

[inventsekar]

some more details please...

some example OUTPUTS​ please

Output shoukd be like like
"Status(field Name) - value(WARN)"
Or
"Field name - WARN"

Also what is the "field name" on this above event?

[DalJeanis]

I believe OP means he wants the value WARN pulled into the field name Status.