How to extract fields from the header?

[mklhs]

Hello,

I would like to leave the

"header.JMSDestination"="topic/testTopic/Durable-Non-Subscription/20"  

the last two fields extract us as a field by creating an eval function so that it looks like the following:
"Durable-Non-Subscription.20" Next step I would like to separate this variable again so that it looks like "Non-Subscription.20". Finally, I need two variables:

"Durable-Non-Subscription.20"
"Non-Subscription.20"

Thank you very much

[manjunathmeti · Accepted solution]

If field header.JMSDestination contains different path with same structure in each events, then you can use this:

| makeresults 
| eval header.JMSDestination="topic/testTopic/Durable-Non-Subscription/20" | append [| makeresults 
| eval header.JMSDestination="nexttopic/nexttestTopic/nextDurable-Non-Subscription/20" ]
| rex field=header.JMSDestination "(?<feild1>[\w-]+/[\d]+)$" 
| rex field=header.JMSDestination "-(?<feild2>[\w-]+/[\d]+)$" 
| eval feild1=replace(feild1, "/", "."), feild2=replace(feild2, "/", ".")

[morethanyell]

Try this

| makeresults 
| eval _raw = "\"header.JMSDestination\"=\"topic/testTopic/Durable-Non-Subscription/20\""  
| rex "testTopic\/(?<field1>[^\"]+)" 
| rex field=field1 mode=sed "s/\//./g" 
| rex field=field1 "Durable-(?<field2>.*)$"