Help to extract fields from the URL

[maria_n]

I need to extract "internal-blue-ocf" as namespace and "stress-b.aps.gc1-b.lle.ocf.xxx.com" as service using rex from the below data.
The condition for the fields should be like,
1) namespace: content between http:// and -oic
2) service: content should start after oic- and ends at .com

MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/

The rex should be used on field called MESSAGE. Please help!

[maria_n]

Thanks @vnravikumar and @kamlesh_vaghela. It worked 🙂

[kartm2020]

Please try the below
| rex field=_raw "http:..(?P\w+-\w+-\w+)-oic-(?P.*.com)"

If the data look likes above, this regex will work. But the data contains numbers in between word. We need to write different regex.
Kindly let me know if it works.

[maria_n]

Sorry, this didn't work @kartm. The above ones shared by kamlesh and ravikumar worked for me. Thanks anyway 🙂

[kamlesh_vaghela]

@maria_n

Can you please try this?

YOUR_SEARCH | rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Sample:

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Thanks

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"