How to extract value using rex?

[ivana27]

Hello,

please, can you tell me how transform and extract value Timeout from next log:

[Error] POS Card Validation - Result: Timeout

using rex?

Thanks a bunch

[ITWhisperer]

| rex "Result:\s(?<result>\w+)"

[ivana27]

Thank you, but problem is that i have other similiar events with Result so i need to specify exactly with this sintax.

[ITWhisperer]

| rex "Result:\s(?<timeout>Timeout)"

Is this what you mean? Or can you provide examples of other events that you don't want to match?

[ivana27]

To be transormed in something like this (i am really new with rex sintax)

| rex field=_raw "\sPOS\sStart\sCardType\:\s(?<CardType>\w+)\,\sTransactionType\:\s(?<TxType>\w+)\,\s"

[ITWhisperer]

| rex "\[Error\]\sPOS\sCard\sValidation\s\-\sResult:\s(?<timeout>Timeout)"