How to edit my rex statement to ignore line breaks to extract the entire value for a certain field?

[marcosrios]

Hello,

I have an event like this:

2016-03-04 00:02:05,546 DEBUG [net.ussouth.aps.shared.util.SysLogUtil] <?xml version="1.0" encoding="UTF-8"?>
<TxnReq xmlns="http://www.us-south.net/namespace/Transaction"><ReqCat>fastcard</ReqCat><ReqAction>Act</ReqAction><ReqRoute>dbservice</ReqRoute><TraceUID>8a848b8d531f68940153400111f417ae</TraceUID><MerchDate>20160304</MerchDate><MerchTime>000206</MerchTime><Product><Track1>;0987789000000000=</Track1><Track2>0987789000000000=</Track2><ExtSerNum>0987789000000000</ExtSerNum><UPC>07675004668</UPC><Denom>840</Denom><Amount>5.0</Amount></Product><Origin><MerchID>Toys R Us</MerchID><StoreID>05927      TOYS</StoreID><TermID>05927100</TermID><TermType>FCMS</TermType><SrcRefNum>087591</SrcRefNum></Origin><Extension><Name>49</Name><Value>USD</Value></Extension><Extension><Name>59</Name><Value>0200      08759105927      TOYS.05927100</Value></Extension><TxnContext><HdrId>53746565</HdrId><ExecutionId>87077798</ExecutionId><StepNbr>1</StepNbr><IncommTransId>8a848b8d531f68940153400111f417ae</IncommTransId><NoPrevTxnFound>false</NoPrevTxnFound></TxnContext></TxnReq>

and I'm using this regex to get some fields from it:

| rex "(?<timestamp>(\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d{3})) (?<loglevel>DEBUG|INFO|WARN|ERROR) (?<origin>\[.*\]) (?<content>.*)" | table timestamp, loglevel, origin, content

I can get all the fields ok except for content that is stopping when it finds a linebreak in the text. How can I make it get all the remaining text and set it in the (content) field?

Regards!

[richgalloway · Accepted solution]

Try using the single-line modifier by putting "(?s)" at the beginning of your regex string.