Extract value from field

[CesarCrt]

Hello everyone,

I have multiple fields and i want to extract an ID from it. (That's the only value that changes in it)

My fields are : class, method, message, nb.

Message field is like this : "] id not found for opp : [12345azeAZE"
I wanted to extract the value after the "[" (in bold) and create a message with it.

Can i have a result like this please :
There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

Thanks.

[CesarCrt · Accepted solution]

I found the solution with your help @vnravikumar 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message

[CesarCrt]

Thanks for your answer @vnravikumar 

It works for the extraction but, i forgot to say that this ID change a lot and with your solution, i only extract one of them.

i have a list of them :

"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)

"] id not found for opp : [75895kezWXE" (B)
"] id not found for opp : [75895kezWXE" (B)

"] id not found for opp : [35856uioAME" (C)

"] id not found for opp : [35856uioAME" (C)

And i want to extract the ID with the number of time that appears

Ex:  (the method and the class doesn't change)

There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

There are 3 errors from the method: $method$ with the class: $class$ on the opp: (A)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (B)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (C)

Thanks.

[vnravikumar]

Hi

Try this

| makeresults 
| eval message="\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [35856uioAME\" (C),
\"] id not found for opp : [35856uioAME\" (C)" 
| makemv delim="," message 
| mvexpand message 
| rex field=message ":\s\[(?P<test>[^\"]+)" 
| stats count by test

[CesarCrt]

I can't do this because, i didn't know the ID (the part after "opp:")  by advance and i had a lot of results.

] id not found for opp : [12345azeAZE

I need to summarize the results with the ID extracted and the number of time it appears.

[vnravikumar]

Hi

Try this rex

| makeresults 
| eval message=" \"] id not found for opp : [12345azeAZE\"" 
| rex field=message ":\s\[(?P<test>[^\"]+)"