Log Lines are as given below
Reports obtained. MyId=NameOne, sId=s0, Reports=true, LogString= url=status.com, Type=base, Available=true, Tag=112434, Token=2356 url=status2.com, Type=error, Available=false, Tag=12345, Token=23567
Reports obtained. MyId=NameTwo, sId=s1, Reports=true, LogString= url=status3.com, Type=base, Available=true, Tag=12345876, Token=2356
I want to create a table as below
MyId | sId | Reports | url | Type | Available | Tag | Token |
NameOne | s0 | true | status.com | base | true | 112434 | 2356 |
NameOne | s0 | true | status2.com | error | false | 12345 | 23567 |
NameTwo | s1 | true | status3.com | base | true | 12345876 | 2356 |
| rex "MyId=(?<MyId>[^,]+).*sId=(?<sId>[^,]+).*Reports=(?<Reports>[^,]+)"
| rex max_match=0 "(?<set>url.*?Type.*?Available.*?Tag.*?Token\S+)"
| mvexpand set
| rex field=set "url=(?<url>[^,]+).*?Type=(?<Type>[^,]+).*?Available=(?<Available>[^,]+).*?Tag=(?<Tag>[^,]+).*?Token=(?<Token>\S+)"
| table MyId sId Reports url Type Available Tag Token
| rex "MyId=(?<MyId>[^,]+).*sId=(?<sId>[^,]+).*Reports=(?<Reports>[^,]+)"
| rex max_match=0 "(?<set>url.*?Type.*?Available.*?Tag.*?Token\S+)"
| mvexpand set
| rex field=set "url=(?<url>[^,]+).*?Type=(?<Type>[^,]+).*?Available=(?<Available>[^,]+).*?Tag=(?<Tag>[^,]+).*?Token=(?<Token>\S+)"
| table MyId sId Reports url Type Available Tag Token