How to extract the severity value from the events with different formats?

[shanmugavelv]

For example - I have the below different types of events under same index, all i need from this is the INFO, DEBUG, ERROR etc.(highlighted ones)

2017-07-11 16:01:52.9853 [10] [host-name] [Rabc.Gtgefsefwe.Sefwerg.werwer] DEBUG: erwer.wer.Sla.wer.wer.dfgdfg, gfh job.
2017-07-13 16:28:48.7464 [16] sdfsdgsdg.werwer.werwerewr DEBUG: Bath erwerwer of 1 triggers
2017-07-13 16:28:47.1820 [5] [hodt-name] Rewerwerg.Dal.tweewtert.ert.ertertertertert`2[[erterting.wsdfsddswwsssjects.sdfsggdg.Dtos.rrtrtw.UsefvbchdftrrtInfoDto, Rttererkng.sdfsdfsdfsdfsdf.weqwrerewt, Version=1.0.0.1, Cuure=neutral, PublicKeyToken=null],[wertwerwng.Data.werwer.werwer.User, rwertwerwe.Data.vgdfgdfg, Version=1.0.6372.25861, Culture=neutral, PublicKeyToken=null]]] INFO: No records to process. No Bulk insert of Entity: dfgdfgdfg.Data.dfgdfg.EntityModels.User is required.

[sbbadri]

try this

your base search | rex field=test "\d+-\d+-\d+\s\d+:\d+:\d+.\d+\S+.*(?P(DEBUG|INFO))"