Extract fields using regex

[siddharthmis]

I have the data like:

2016-09-09 06:21:31,858 ... blah ... blah...
... ORA-00001: unique constraint (AN_FIELD.CODE) violated...
... ORA-06512: at "AN_FIELD.DATA_TRANSFER", line 5523...

I would like to extract "ORA-00001: unique constraint (AN_FIELD.CODE) violated" and "FIELD" separately.

How can I do this?

[siddharthmis]

Both seems to work, Thanks for the super fast response.

[richgalloway]

Try this

(?<msg>ORA-00001:.*?_(?<field>[^\.]+)\..*violated)

[sundareshr · Accepted solution]

See if this works

... | rex "(?<msg>ORA.*\(AN\_(?<field>\w+).*)" | table msg field