How can I rex on an exact error code?

[splgeek]

Hello ppl
I have a set of Error messages in an event log that looks like this
ERROR [43f796d8da] there are several codes like this in the events, so i don't want to miss out extracting them

What would be the rex command so that I could extract the Error codes and assign it to a field called Errortype?

[ehudb]

|rex "\w+\s\[(?<Errortype>[^\]]+)]"

Explanation:
A. Word with one or more letter
B. one or more space
C. starting bracket '['
D. One or more Non-Closing bracket ']' character (will be the field value)
E. Closing bracket ']'

[gokadroid · Accepted solution]

If the error code exists once in every log event then try these please:

1) If you want the ERROR word and square brackets in the string as well:

yourBaseSearch
| rex "(?<Errortype>ERROR\s\[[^\]]+\])"
| complete your query using Errortype field

See result here

2) If you only want only the code within the brackets, try:

yourBaseSearch
| rex "ERROR\s\[(?<Errortype>[^\]]+)\]"
| complete your query using Errortype field

See results here