Below is the sample event
event_type: LogMessage ip: xx.x.xx.xx job: router_z1 job_index: 1 level: info message_type: OUT msg: url.com - [04/01/2017:19:37:03.701 +0000] "GET /api/v1/vha/supported-vehicles HTTP/1.1" 200 0 1565 "-" "fordpass-app-na/17 CFNetwork/808.2.16 Darwin/16.3.0" xx.x.xx.xx:45810 x_forwarded_for:"xxx.xx.xxx.xx, xx.xx.xx.xxx, xx.x.xx.xx" x_forwarded_proto:"https" vcap_request_id:8d612e09-f611-415f-6172-a688700be726 response_time:0.004987 app_id:19065d0e-f6da-4cc3-8a71-581fd768dafe origin: gorouter source_instance: 1 source_type: RTR time: 2017-01-04T19:37:03Z timestamp: 1483558623706728200
I am trying to extract the "GET /api/v1/vha/supported-vehicles " and other similar kinds like "POST /oauth/token", "GET /eureka/apps/delta" ,GET /api/v1/badges,"GET /api/v1","POST /api/v1/humanify-session" etc in the message field.
I tried using the erex command
erex clean examples="GET /api/v1/badges,GET /api/v1,POST /api/v1/record"
but it is not showing all of them and I also tried using IFX, but I can only select one field...
Is there any other way to extract all these fields from the msg app other than regex...
Thanks for the help
If your logs and the string that you're trying to extract is not formatted in a standard way (they don't follow same patter/position for all events), the erex and IFX may fail to extract all values. Using your custom regular expression which will explicitly take care of all variation is the way to go in cases like that.
You'll be able to save the regular expression that you used in search as field extraction, so that its automatically available (similar to what IFX would have done).
POST is all you are interested in then you can try this as well:
your base search | rex "\"(?<actionUri>(GET|POST)\s*?[\S]+)" | table actionUri
If additional actions are needed feel free to add in
(GET|POST|...) part of the above