How to Extract specific word from application log

[iqbalintouch]

Here is the sample log and I need to check which modelId is having most of the error using rex and stats count

####<Jan 11, 2021 11:17:52.338 PM PST> <ERROR> <myapp.main.catalog.store.trxn.OrderResponseValidator> <bus-ser15> <bus-ser1515_5> <requestId=9c4q00cv-e10x-00b4-z55f-11b44dc4c37m> <clientIp=11.22.33.222> <myapp.main.catalog.store.trxn.OrderResponseValidator.logOrderResponseValidationError(?:?):Productadd service error for modelId 765431 and reference number null[Model is not available in the store], [An error has occurred. Please verify your order status.]>

Can someone please help?

[scelikok · Accepted solution]

Hi @iqbalintouch,

You can use below query;

| rex field=_raw "modelId\s(?<modelId>\d+)"
| stats count by modelId

If this reply helps you an upvote is appreciated.

[iqbalintouch]

Hi @scelikok ,
thank you, I was looking for this thing exactly. Sorry for the late reply 🙂