Here is log example -
I need to extract string after ids/ untill first ? or :
So output would be - getOrCreate/bulk
I am trying this -
What am I missing?
Please, try the following:
| rex field=log "ids\/(?<url>[^\?|\:]+)"
If your "log" field is not presenting the log example that you used, you can try substitute field=log to field=_raw
View solution in original post
Thank for your responses, this works -
I saw some of my logs don't have "ids/" in them, in that case url turns out to be blank. Here how can I perform an OR operation to calculate url as - rex field=log "com\/(?<url>[^\?|\:\/ ]+)"
That is -
if - "ids\/(?P<url>[^?:\s]+)" return blank then extract url as - "com\/(?<url>[^\?|\:\/ ]+)"
@ashvini_mishra Try this:
| rex field=_raw "ids\/(?P<url>.*?)\?"
if this is some fieldname then just replace _raw by your fieldname, or use the below rex:
| rex field=log "ids\/(?P<url>.*?)\?"
Also, If this reply helps you, an upvote would be appreciated.