I have an event in the following format
2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC
These are already part of the "message" field. How do I extract npid, groupId, dom, source as different fields? These should be extracted as fields going forward.
Any pointers are appreciated!
| makeresults
| eval message="2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
|rex field=message ".*Bolt\=(?<Bolt>[^\|]+)"
|rex field=message ".*source\=(?<source>[^\|]+)"
|rex field=message ".*dom\=(?<dom>[^\|]+)"
|rex field=message ".*groupId\=(?<groupId>[^\|]+)"
|rex field=message ".*npid\=(?<npid>[^\|]+)"
|table message Bolt source dom groupId npid
hello there:
runt this search anywhere:
| makeresults count=1
| eval _raw = "2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
| rex field=_raw "(?<time>\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2})\s+\[(?<something>[^\[]+)\[(?<some_digits>[^\]]+)\]\]\s+(?<log_level>[^\s]+)\s+(?<some_fqdn_maybe>[^\:]+)\:(?<maybe_port>\d+)\s\-\s(?<everything_elde>.+)"
| extract pairdelim="|", kvdelim="=:"
to make it permanent use props.conf
you can also use the interactive field extractor
hope it helps
Something in the spirit of .*source=(?<source>\w*).*dom=(?<dom>\w*)
...