How do i regex the numbers for the following hung thread log message...?

[prakash007]

Looking for a regex in 612,200(threadDuration) and 3(no.of.Threads) for the log message below...

WSVR0605W: Thread “WebContainer : 1” has been active for 612,000 milliseconds and may be hung. There are 3 threads in total in the server that may be hung.

[skoelpin · Accepted solution]

Here's a regex that will extract the number of ms

The field is called Time

... | rex (?P<Time>(?<=been\sactive\sfor\s)\d+\,\d+(?=\smilliseconds))

Here's the regex for number of threads which the field is called Threads

... | rex (?P<Threads>(?<=There\sare\s)\d)

[richgalloway]

This works on regex101.com with your sample event.

... | rex "for (?<threadDuration>[\d,]+).*?(?<threadCount>\d+) threads" | ...