I've got some log data that has a multi-line event this format:
2011-04-28 11:40:00|ACTION|1304005199906869|stuff|stuff|stuff
SPARAM|1304005199906869|PartNumber|1613034
SPARAM|1304005199906869|OtherParameter|8528
SPARAM|1304005199906869|OtherParameter2|true
I've created a regex to pull out the PartNumber field, and it seems to work perfectly when I run it through rex:
... | rex field=_raw "(?m)^SPARAM\|\d*\|PartNumber\|(?<SearchPartNumber>.*)"
Result: "1613034"
When I take the same regex and make it a saved Field extraction, I get the value I want plus everything else to the end of the event.
Result: "1613034
SPARAM|1304005199906869|OtherParameter|8528
SPARAM|1304005199906869|OtherParameter2|true"
I've tried adding an optional newline or end of line character to the end of the regex and it doesn't help.
Any thoughts on why this would behave differently and what I can do to fix it?
Thanks.
The (?s) option defaults differently.
Use (?m-s)^SPARAM
at the beginning, or else (?<SearchPartNumber>\V*)
to prevent .
from matching across line breaks.
The (?s) option defaults differently.
Use (?m-s)^SPARAM
at the beginning, or else (?<SearchPartNumber>\V*)
to prevent .
from matching across line breaks.
Thanks so much for the prompt response. That fixed it!