Dears,
please help. I have log like this
[Information] PosService AddInfo:[5006] - Stop customer
And i want to show in table message after ":", currently i am using rex like this but i dont have result:
| rex field=_raw "PosService\sAddInfo\:(?<addinfo>\w+|)"
Thank you!
Hi @ivana27,
if the code you need to display is only the code between square parenthesis, you could use a regex like this:
| rex "PosService\s+AddInfo:\[(?<addinfo>\d+)"
as you can see at https://regex101.com/r/dtpR2J/1
If instead you need to display all the message until the end of the row, you have to use the following regex:
| rex "PosService\s+AddInfo:(?<addinfo>.+)"
as you can see at https://regex101.com/r/dtpR2J/2
Ciao.
Giuseppe
Hi @ivana27,
if the code you need to display is only the code between square parenthesis, you could use a regex like this:
| rex "PosService\s+AddInfo:\[(?<addinfo>\d+)"
as you can see at https://regex101.com/r/dtpR2J/1
If instead you need to display all the message until the end of the row, you have to use the following regex:
| rex "PosService\s+AddInfo:(?<addinfo>.+)"
as you can see at https://regex101.com/r/dtpR2J/2
Ciao.
Giuseppe