How to extract the status values from the following events?

[pench2k19]

Hi Team,

I have following two events from where i need to extract the status

)V 2019-03-11 msp raw utility_extract13L hdfs:/datalake/consumer/msp/raw/tmp/MSP_DELTA_PR936_UTILITY_EXTRACT13_190311" consumer_msp_raw.utility_extract13 utility_extract13_DELTA_9362019-03-12 06:10:21.9803272019-03-12 06:26:09.014586: warning - 35% data volume threshold reached, expected 2000

)V 2019-03-11 msp raw utility_extract13L hdfs:/datalake/consumer/msp/raw/tmp/MSP_DELTA_PR936_UTILITY_EXTRACT13_190311" consumer_msp_raw.utility_extract13 utility_extract13_DELTA_9362019-03-12 06:10:21.9803272019-03-12 06:26:09.014586 success

I need to extract the two highlighted status values into single filed, can you please help here. Thank you

@jkat54 @vnravikumar

[vnravikumar]

Hi @pench2k19

Try this rex

|rex field=msg "\.\d+(:\s+|\s+)(?P<status>.+)"

[somesoni2 · Accepted solution]

Here you go

https://regex101.com/r/62jE8k/1