Hi I am trying to make a dashboard that searches events and extracts the correlationId from the event so I can display that information in a cleaner manner. I just want to be able to extract the correlationId using my search and it comes in two main patterns.
The first event pattern
and the second pattern
My current search is
My ultimate goal is to make a table with a Correlation ID column and other vital information columns
I have not edited the source code yet, so please feel free to leave any feedback or clarifying questions if needed
Please post text rather than screen shots so we can use it in test cases.
| rex "correlationId(='| )(?<correlationId>[0-9a-fA-F-]+)"
Single quote might need escaping with a back-slash i.e. (=\'| )