Hi,
My logs are in following format:
{[-]
logger: .......
message: ..........
severity: Error
}
{[-]
exception: .........
logger: .......
message: ..........
severity: Error
}
my query is :
........| rex "\"exception\":\"(<ErrorMsg>.*?)\"" | table Application, ErrorMsg
The issue:
As some app logs have key "message" and some logs have both "exception" and "message".
How can I change my query that first it checks if there is key exception, if it does get the value of that key. If there is no Key exception check if there is key "message", if it does get the value of that.
My current query is able to get the value of exception (if I change exception to message, it gets the value of message. But trying to implement IF or CASE condition here)
