How do I extract the following which always occurs as the last part of the raw text in message e.g "Took 13983.1468ms."
I want only the number and to capture timestamp and hostname. The total message length and structure might vary slightly but the ending is the same.
I'd use rex
.
index=foo | rex "Took (?<num>\d+\.?\d+)ms" | ...
If you need help extracting timestamp and hostname, please show some sample data.
| rex "Took (?P<dur>\d+\.?\d*)ms"
Will put the value into dur
I'd use rex
.
index=foo | rex "Took (?<num>\d+\.?\d+)ms" | ...
If you need help extracting timestamp and hostname, please show some sample data.
I think that regex is going to surprise in some situations. You are requiring that there be 2 digits. 1 or more digits, followed by optional decimal, followed by 1 or more digits.
There will always be at least x.x
To alert on certain values, schedule a search for those values.
index=foo | rex "Took (?<num>\d+\.?\d+)ms" | where num > someThreshold | table _time hostname num
Have the search trigger an alert if the number of results is not zero.
Many thanks for the answer!
You would use a regular expression..
Try this
| rex (?P<Time>(?<=Took\s)\d+(?=ms))
This doesn't allow for decimals.
Sorry about that, try this
| rex (?P<Time>(?<=Took\s)\d+\.\d+(?=ms))
Whats the easiest way to search the result set and then alert on a threshold value(s). Do I need to pass this into a command to build a table first?
No you don't need to do that, you can add a | where
clause such as
... | where Time > 2