How to extract two fields using regex?

[karthi2809]

How to extract the two fields from the message ?

In this need to extract after API: START: /v1/expense/extract/demand/

nagl as one field .

demand _con.csv in another field

I am extracting 

|rex field=message max_match=0 "API: START: /v1/expense/extract/odemand/ (?<OnDemandFileName>[^\n]\w+\S+)"

API: START: /v1/expense/extract/demand/nagl/demand_con.csv

[ITWhisperer]

Try something like this

|rex field=message max_match=0 "API: START: /v1/expense/extract/demand/(?<oneField>[^\/]+)\/(?<anotherField>\S+)"

[karthi2809]

Working 👍

[gcusello · Accepted solution]

Hi @karthi2809,

if the first field is called app and the second is called OnDemandFileName, you can use this regex:

|rex field=message max_match=0 "API: START: \/v1\/expense\/extract\/demand\/(?<app>[^\/]+)\/(?<OnDemandFileName>.*)"

that you can test at https://regex101.com/r/uifAqM/1

Ciao.

Giuseppe