Hi Everyone,
Trying to get the expression to read first match from the end off the line and not the beginning of the line.
| makeresults | eval TEST="beginning of line Facility=test341 Message=test123 end of line" | rex field=TEST max_match=0 "(?i)(?<testfromend>(Facility\=|Message\=)[^$]*)" | mvcombine testfromend
Was hoping this would extract "Message=test123 end of line". Instead i get Facility= and everything after because its reading from the beginning of the line still.
Hey subtrakt,
try this one:
(?i).*(?<testfromend>(Facility\=|Message\=)[^$]*?)$
Update: even better:
(?i)(?<testfromend>(Facility\=|Message\=)[^\=]*?)$
Hey subtrakt,
try this one:
(?i).*(?<testfromend>(Facility\=|Message\=)[^$]*?)$
Update: even better:
(?i)(?<testfromend>(Facility\=|Message\=)[^\=]*?)$
I ended up using the first solution.
I guess the .* enables the search from end of line and a more flexible option.
Hey subtrakt,
why not use (?i)(?<testfromend>Message\=[^$]*)
then?
BUT... if you want to extract the value of facility and of message do the following:
(?i)Facility=(?<facility>[^\s]*)\s*Message=(?<message>.*)
https://regex101.com/r/DGZX5X/1
There's other cases in the logs that require different conditions searching from the end of the line.
After testing around all those conditions I found the answer selected was the best global option.
Thanks Pyro.
Just experimenting without using eval and creating unnecessary fields. The condition requires message to always take precedence.
Sometimes Message= is not in the log. Sometimes it is. When message is not in the log, it needs to capture Facilility to end of line.