How to create a table?

[minpd0309]

HI, I want to make the log below in the form of the table below. What should I do with the spl?

[log ex] 

14:39:19.857 INF [md_system_user] remove success [user id:kimkimkim] by [id:tom]

[table]

user id	id
kimkimkim	tom

[gcusello · Accepted solution]

Hi @minpd0309,

you have to extract (using a regex) the fields and then run something like this:

index=your_index
| rex "\[user id:(?<user_id>\w+)\]\s+by\s+\[id:(?<id>\w+)"
| table user_id id

you can test the regex at https://regex101.com/r/HUeULf/1

Ciao.

Giuseppe