How to extract below field from logs ?

[Dinesh_Raja]

Hello,

I need to create a dashboard which shows error messages & its count over the time. i have a logfile like below and i would like to extract the error message as a field.

"[syncservice] [ERROR] [20 Mar 2018 04:09:56,654] : [7dfhsdgw-4dgsj-ashgah-svahs5226] : [com.xxx.xxxx.xxxx.xxxx]: Failed to invoke service xxx.xxxxxx.xxxx.ConnectorException: IOException occurred for ServiceLogMessage while obtaining response: Connection to http://localhost:8080 refused"

[cmerriman · Accepted solution]

based on @tiagofbmm 's answer, try this | rex field=_raw "ConnectorException:\s(?<ConnectorException>.*)"

you can test out regex's at this website: https://regex101.com/
it is a great place to learn and test out what you're doing.

[Dinesh_Raja]

Hello @cmerriman,
Yes, it works & Thanks for sharing the knowledge 🙂

[tiagofbmm]

Working solely on the example you gave in the question,

| rex field=_raw "ConnectorException:s(?.*)"

[Dinesh_Raja]

Hello @tiagofbmm,
Thanks for the answer.
But, i m getting error as "Error in 'rex' command: Encountered the following error while compiling the regex 'ConnectorException:s(?.*)': Regex: unrecognized character after (? or (?- "

[tiagofbmm]

My bad, forgot to put it as Code

| rex field=_raw "ConnectorException\:s(?<ConnectorException>.*)"

[tiagofbmm]

Please upvote and accept answers

[493669]

...| rex field=_raw "ConnectorException\:s(?<errormsg>.*)"

[Dinesh_Raja]

Thanks for your answer @493669.
:)