I have the below sample events
8 Aug 2017 14:45:54 [WARN ] http_srv: Total latency exceeded threshold: 0.180145 seconds (internal 0.180000 s) origin 0.140000 seconds MCHit 0 Status: **200** IP: 69.xxx.xxx.13:2062 URL:
sample event 2
18 Aug 2017 15:06:30 [WARN ] http_cli: Origin latency exceeded threshold: 0.141100 seconds GET Status: **200**[OK] Bytes: 10081 Origin URL: http://linear-scope010.com/LIVE/1007/hls/ae/MSNBC_HD/900.m3u8 refReqId 13542238 reqWait 0 (id 3289754508)
sample event 3
Aug 2017 17:58:07 [WARN ] http_srv: DONE 4199750 0.023084 **404**[Not ...
sample event 4-this does not have the http code
22 Aug 2017 15:50:27 [WARN ] Content Generator: Discontinuity Sequence mismatch adding 982 at frag 1989008, adjusting previous (id 26007997)
I want a help with regex to extract the HTTP Response codes of events which have httpsrv or httpcli in the events and save them in field called HTTP_Code .
Thanks in advance
I'm not able to extract HTTPValues for all samples using only one regex, but I can do it in two regexes:
to extract HTTPCode from samples 1, you can use the following regex
instead for the Sample 2 and 3 use this regex
After you can merge results using coalesce function:
| eval HTTP_Code=coalesce(HTTP_Code1,HTTP_Code2)