Field conditions with custom delimiter

[mcvaylk]

I'm using custom delimiters to extract fields from the logs of a rails app. Following the advice of an answer on this site (not enough rep to link), my query looks like this:

index="product" sourcetype="app" status=200 | extract pairdelim=", }{", kvdelim="=>", auto=f

A log message looks like this:

UserController -- Completed #index -- { :action => "index", :db_runtime => 54.64, :format => "HTML", :method => "GET", :mongo_runtime => 0.0, :path => "/users", :status => 200, :status_message => "OK", :view_runtime => 709.88 }

The delimiter seems to work, because when I remove "status=200" from the query, it returns results with the fields as expected. However, when I click "Add to search" for a value where status was 200, it puts the condition in the query as shown above and returns no results. My suspicion is that the condition will need to be added in another pipe command. Can someone point me in the right direction?

[gcusello]

Hi mcvaylk,
probably it isn't an elegant solution, but using regexes you have a more flexible solution and you probably don't have the described problems.
Try something like this:

\{\s:action\s\=\>\s\"(?<action>[^\"]*).*:db_runtime\s\=\>\s(?<db_runtime>[^,]*).*:format\s\=\>\s\"(?<format>[^\"]*).*:method\s\=\>\s\"(?<method>[^\"]*).*:mongo_runtime\s\=\>\s(?<mongo_runtime>[^,]*).*:path\s\=\>\s\"(?<path>[^\"]*).*:status\s\=\>\s(?<status>[^,]*).*:status_message\s\=\>\s\"(?<status_message>[^\"]*).*:view_runtime\s\=\>\s(?<view_runtime>[^ ]*)

You can test it at https://regex101.com/r/jMBtsp/1

Bye.
Giuseppe

[woodcock · Accepted solution]

You EITHER need to make this an automatic field extraction OR do your search (manually, not with the click->menu) like this:

index="product" sourcetype="app"
| extract pairdelim=", }{", kvdelim="=>", auto=f
| search status="200"

[mcvaylk]

The "search" command is exactly what I was looking for. Thanks!