How to REX an entire line if it contains a keyword

[like2splunk]

I want to REX an entire line if it contains a particular keyword. The event looks like this:

2017-03-08 10:34:34,067 [ WARN] {Application Queue} (com.iba.tcs.beam.bds.devices.impl.gateway.rpc.ScanningControllerProxy) - ScanningController failure: NECU Transitioned to Error State
NECU Error: [0x0] _SynchronizationSGCUTimeout : Timeslice: 163 Submap: 83
FCU Error: [0x0] _SynchronizationSGCUTimeout : Timeslice: 163 Submap: 83
RCU Error: [0x1] Threshold Violation : Timeslice: 162 Submap: 83
(X_VOLT_SEC_FB: -1.858963 V MapThresholdLow: -6.005e-02 MapThresholdHigh: 4.256e-01)
SGCU Error: [0x10] _FilteringAbsolute : Timeslice: 159 Submap: 83
(MIN_CHARGE_PRIM: 6.159e-10 C AbsoluteThresholdLow: 7.119e-10 AbsoluteThresholdHigh: 7.569e-10)

This is one single event (one timestamp) with five total lines. I want to rex each one of the errors separately but I need to preserve the label. For example, I want the following the be the result of the rex from this event:

FCU Error: [0x0] _SynchronizationSGCUTimeout : Timeslice: 163 Submap: 83

In this case, the keyword is "FCU Error" but I need to keep that string instead of rexing everything after this string.
How do I rex the entire line if it matches this keyword?

[somesoni2]

How about this?
If the order of different types of error is fixed, they try like this

Your base search
| rex "NECU Error:\s*(?<NECU_ERROR>.+)([\r\n]+)FCU Error:\s*(?<FCU_Error>.+)([\r\n]+)RCU Error:\s*(?<RCU_Error>.+)([\r\n]+)SGCU Error:\s*(?<SGCU_Error>.+)"

If not then, try like htis

your base search
| rex "NECU Error:\s*(?<NECU_ERROR>.+)"
| rex "FCU Error:\s*(?<FCU_Error>.+)"
| rex "RCU Error:\s*(?<RCU_Error>.+)"
| rex "SGCU Error:\s*(?<SGCU_Error>.+)"

[richgalloway · Accepted solution]

This works for me in regex101.com:

(?<error>FCU Error: .*)