Hello,
I have an event like this:
2016-03-04 00:02:05,546 DEBUG [net.ussouth.aps.shared.util.SysLogUtil] <?xml version="1.0" encoding="UTF-8"?>
<TxnReq xmlns="http://www.us-south.net/namespace/Transaction"><ReqCat>fastcard</ReqCat><ReqAction>Act</ReqAction><ReqRoute>dbservice</ReqRoute><TraceUID>8a848b8d531f68940153400111f417ae</TraceUID><MerchDate>20160304</MerchDate><MerchTime>000206</MerchTime><Product><Track1>;0987789000000000=</Track1><Track2>0987789000000000=</Track2><ExtSerNum>0987789000000000</ExtSerNum><UPC>07675004668</UPC><Denom>840</Denom><Amount>5.0</Amount></Product><Origin><MerchID>Toys R Us</MerchID><StoreID>05927 TOYS</StoreID><TermID>05927100</TermID><TermType>FCMS</TermType><SrcRefNum>087591</SrcRefNum></Origin><Extension><Name>49</Name><Value>USD</Value></Extension><Extension><Name>59</Name><Value>0200 08759105927 TOYS.05927100</Value></Extension><TxnContext><HdrId>53746565</HdrId><ExecutionId>87077798</ExecutionId><StepNbr>1</StepNbr><IncommTransId>8a848b8d531f68940153400111f417ae</IncommTransId><NoPrevTxnFound>false</NoPrevTxnFound></TxnContext></TxnReq>
and I'm using this regex to get some fields from it:
| rex "(?<timestamp>(\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d{3})) (?<loglevel>DEBUG|INFO|WARN|ERROR) (?<origin>\[.*\]) (?<content>.*)" | table timestamp, loglevel, origin, content
I can get all the fields ok except for content that is stopping when it finds a linebreak in the text. How can I make it get all the remaining text and set it in the (content) field?
Regards!
