How to extract the field with regex

[danielwan]

I would like to extract the field of "/home/y/conf/video_dir.conf" with regex when the event contains "critical" keyword (there are some other state keywords like "normal", "debug")

2011-01-01 01:49:00 UTC [ critical] [ PID=14154][ GENERAL] File /home/y/conf/video_dir.conf doesn't exist or not readable.

I ran '... | rex field=_raw "^.critical.*File\s+(?)\s+.$" but it's not working. Any advice on making it work?

[inventsekar · Accepted solution]

Please try -

 sourcetype="video" | rex field=_raw "critical.*File\s(?<dir>.*)\sdoes" | table _raw dir