Extract field with multiple potential formats

[yk010123]

I have log entries that have the following format :

[<connectorName>|<scope>]<sp>

The following are examples of the connector context for a connector named "my-connector":

• [my-connector|worker]
• [other-connector|task-0]
• [my-connector|task-0|offsets]

I would like to extract the name of the connectors and build stats. The tasks or other metadata are not needed. For example :

Connector	Count
my-connector	2
other-connector	2

As the entries have different formats, how can I do this?

[scelikok]

Hi @yk010123,

You use below;

| rex field=_raw "\[(?<connector>[^\|]+)"
| stats count by connector