Field extraction

[sandeepmakkena]

gauge="ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE" is one of the field.
I am trying to get Country, Processor, PaymentType and reason fields.

my search
| rex "Country[(?[^]]+)]Processor[(?[^]]+)]PaymentType[(?[^]]+)] (?[^"]+)"

I am using this but its not working, can someone help please.

Thanks for your time.

[vinod94]

Hi dyude @sandeepmakkena ,

You can try this ,

index=your index
|rex field=gauge "ProcessorResponse\.Country\[(?P<Country>.+)\]Processor\[(?P<Processor>.+)\]PaymentType\[(?P<PaymentType>.+)\]\s(?P<reason>\w+)"

[adonio · Accepted solution]

try this:

| makeresults count=1
| eval gauge="\"ProcessorResponse.Country[US]Processor[ApgProcessor]PaymentType[VISA] DECLINE\""
| rex field=gauge "\.Country\[(?<country>[^\]]+)\]Processor\[(?<processor>[^\]]+)\]PaymentType\[(?<payment_type>[^\]]+)\]\s+(?<result>[^\"]+)"

hope it helps

[sandeepmakkena]

Thank you.