First match from end of the line regex

[subtrakt]

Hi Everyone,

Trying to get the expression to read first match from the end off the line and not the beginning of the line.

| makeresults | eval TEST="beginning of line Facility=test341 Message=test123 end of line" | rex field=TEST max_match=0 "(?i)(?<testfromend>(Facility\=|Message\=)[^$]*)" | mvcombine testfromend

Was hoping this would extract "Message=test123 end of line". Instead i get Facility= and everything after because its reading from the beginning of the line still.

[bjoernhansen · Accepted solution]

Hey subtrakt,

try this one:

(?i).*(?<testfromend>(Facility\=|Message\=)[^$]*?)$

Update: even better:

(?i)(?<testfromend>(Facility\=|Message\=)[^\=]*?)$

[subtrakt]

I ended up using the first solution.

I guess the .* enables the search from end of line and a more flexible option.

[horsefez]

Hey subtrakt,

why not use (?i)(?<testfromend>Message\=[^$]*) then?

BUT... if you want to extract the value of facility and of message do the following:
(?i)Facility=(?<facility>[^\s]*)\s*Message=(?<message>.*)
https://regex101.com/r/DGZX5X/1

[subtrakt]

There's other cases in the logs that require different conditions searching from the end of the line.

After testing around all those conditions I found the answer selected was the best global option.

[subtrakt]

Thanks Pyro.

Just experimenting without using eval and creating unnecessary fields. The condition requires message to always take precedence.

Sometimes Message= is not in the log. Sometimes it is. When message is not in the log, it needs to capture Facilility to end of line.