How to extract a word between two words?

[spatt]

stream=stdout 9 INFO [DataEnrichmentController] (default task-597) start : comm-uuid : rsvp-service : nljnj42343n43k

stream=stdout 4 INFO [DataEnrichmentController] (default task-760) start : commID : rsvp-service : nk324kjln4kj34

stream=stdout 4 INFO [DataEnrichmentController] (default task-760) start : comm-uuid : rsvp-service : vflijiopjoe1442kljn;k23

I want to extract the highlighted word from above log lines

[yuanliu]

Alternatively, you can count the separators, like this

| eval myfield = mvindex(split(_raw), " : "), 2)

[gcusello]

Hi @spatt,

please try this regex:

| rex "start\s+:[^:]*:\s+(?<your_field>[^:]*)"

or this one:

| rex field=stream "start\s+:[^:]*:\s+(?<your_field>[^:]*)"

that you can test at https://regex101.com/r/lWKlbK/1

Ciao.

Giuseppe