I have a field "facilityAlias" for which location can be changed in every api log file. I have to extract that field using Regex method. I have tried Regex statement but not getting expected result.
Regex statement: rex field=_raw "facilityAlias\":\"(?<facility>.*)\","
expected result: Parc de Salut Mar Barcelona
current result: Parc de Salut Mar Barcelona","systemName":"CMPSB
Sample Log file:
sample log: 2023-01-02 23:36:58,521 [[MuleRuntime].uber.3869: [abcd-message-kdhskhdsk-api].Delete_msg_from_queue.BLOCKING @27fe0275] INFO com.skdhksh.jsdhjshd.hsd.logging.internal.CustomLoggerOperations - {"environment":"stag36rcf_eu-env","applicationName":"abcd-message-kdhskhdsk-api","correlationId":"kshddhks-3o4u-jshd8-aksdbkadkahd","apiProcessingTime":347,"totalProcessingTime":740,"tracePoint":"END","logMessage":"{\n \"url\": \"abcd\",\n \"bucketName\": \"dipeus-data-store\",\n \"s3versionID\": \"shdkshdkshdkshdkshdkshdkjshd\",\n \"s3key\": \"ljdljdlajldj]dsdsd\ksdjksjdksjdksjdksjksjd\ksdjksjd\"\n}","txnMetadata":{"bundleId":"ahsdkhsdh-skjdhshdkshd-skdhshdks-skdhkshd","messageType":"abcd","messageSubType":"kdshdkshdks","facilityAlias":"Parc de Salut Mar Barcelona","systemName":"CMPSB","transactionStartTime":1672702617781,"relatesToPatientMerge":false,"inputPayload":"adhkjshdkshdkshdkshd"},"apiStartTime":"1672702618174"}
Hi @MrIncredible,
you can use:
| rex "facilityAlias\":\"(?<facility>.*)\",\"systemName"
or (better):
| rex "facilityAlias\":\"(?<facility>[^\"]*)"
that's more generic and you can test at https://regex101.com/r/jnbSgk/1 .
Ciao.
Giuseppe
Many thanks @gcusello for your quick reply. 2nd option will work as in 1st option i don't want to restrict it with particular postfix.
Hi @MrIncredible,
you can use:
| rex "facilityAlias\":\"(?<facility>.*)\",\"systemName"
or (better):
| rex "facilityAlias\":\"(?<facility>[^\"]*)"
that's more generic and you can test at https://regex101.com/r/jnbSgk/1 .
Ciao.
Giuseppe