Hello,
I have a raw data that go like this
...
in[ 60: ]<3034>
in[ 62: ]<10>
in[ 62: ]<EC_CARDVER>
...
I want to extract the EC_CARDVER to a field name msg
My rex is
| rex field=_raw "(in)\[ 62: \]\<(?P<msg>)\>"
But it doesn't seem to catch on. How do I write to extract only the EC_CARDVER but not the 10 above it?
Assuming the difference is the first character must not be numerical, try
| rex "in\[ *\d+: *]<(?<msg>\D[^>]+)"(You don't need to specify field when using _raw.)
Assuming the difference is the first character must not be numerical, try
| rex "in\[ *\d+: *]<(?<msg>\D[^>]+)"(You don't need to specify field when using _raw.)
Your query extract a different fields than what I want, because there're many rows that have 'in [ ]' before, so I tweak it a bit
| rex "in\[ *62+: *]<(?<msg>\D[^>]+)"Then it work just the way I want it to. Thank you