This is the string in the log
I 2019-05-23 18:22:38.984Z 7881 216 XObk7A6CU-I62gr3UIKfXQAAAAs 1@43465473@A WPB-Log: file=/users/aa/test.cls method=fetchdata ID=Qwe123
I want to extract a field marked as bold to build a table.
Please note that all strings are variable so the rex should be generic.
Thanks for the help!
Assuming that data is always in the same place this should grab it:
| rex "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}Z \d+ \d+ (?<fieldName>[^\s]+)"
You'll need to choose the field name you want and replace fieldName with whatever you want to label that field. Here's a link to regex 101 that shows it working on the single example you provided: https://regex101.com/r/TdkzcA/1
Give this a try (assuming the value you want to extract is 6th element from the start)
your base search
| rex "^(\S+\s+){5}(?<YourField>\S+)"
It worked too
Assuming that data is always in the same place this should grab it:
| rex "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}Z \d+ \d+ (?<fieldName>[^\s]+)"
You'll need to choose the field name you want and replace fieldName with whatever you want to label that field. Here's a link to regex 101 that shows it working on the single example you provided: https://regex101.com/r/TdkzcA/1