How to extract container name and ID from a log using regex?

[pavanmishra0102]

(Item Id: 45) Container Name: Abc Admin Accounts (Container Id: 19) suid=1

need to extract Container name & Container id from the above partial log posted here using regex. Kindly help. Thanks in advance

[rnowitzki · Accepted solution]

Hi @pavanmishra0102 ,

This should do it:

Container\sName:\s(?<container_name>.*)\((?<=\()Container\sId:\s(?<container_id>\d+)\)

BR
Ralph
--
Karma and/or Solution tagging appreciated.

[isoutamo]

Hi

this helps you:

index=_internal
| head 1
| eval _raw ="(Item Id: 45) Container Name: Abc Admin Accounts (Container Id: 19) suid=1"
| rename COMMENT "Previous sets sample data, next line select values"
| rex "Container Name: (?<CName>[^\(]+)\(Container Id: (?<CId>\d+)"

r. Ismo