How do I extract a field from another field?

[rohinisb91]

I have an event in the following format

2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC

These are already part of the "message" field. How do I extract npid, groupId, dom, source as different fields? These should be extracted as fields going forward.

Any pointers are appreciated!

[saurabhkharkar]

| makeresults 
| eval message="2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
|rex field=message ".*Bolt\=(?<Bolt>[^\|]+)"
|rex field=message ".*source\=(?<source>[^\|]+)" 
|rex field=message ".*dom\=(?<dom>[^\|]+)" 
|rex field=message ".*groupId\=(?<groupId>[^\|]+)" 
|rex field=message ".*npid\=(?<npid>[^\|]+)" 
|table message Bolt source dom groupId npid

[adonio]

hello there:

runt this search anywhere:

| makeresults count=1
| eval _raw = "2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
| rex field=_raw "(?<time>\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2})\s+\[(?<something>[^\[]+)\[(?<some_digits>[^\]]+)\]\]\s+(?<log_level>[^\s]+)\s+(?<some_fqdn_maybe>[^\:]+)\:(?<maybe_port>\d+)\s\-\s(?<everything_elde>.+)"
| extract pairdelim="|", kvdelim="=:"

to make it permanent use props.conf
you can also use the interactive field extractor

hope it helps

[ddrillic]

Something in the spirit of .*source=(?<source>\w*).*dom=(?<dom>\w*)...