How to format event in search

[gentcore]

Hi,

I am running a search and the event structure is displaying as:

{ [-]
   line: 2019-09-27 11:47:29,696 [server] INFO  [http-nio-8079-exec-1] [] [] o.s.w.s.DispatcherServlet | Completed initialization in 7 ms
   source: stdout
   tag: 1445465d0f2e
}

Is there any way i can just have the event display as:

2019-09-27 11:47:29,696 [server] INFO  [http-nio-8079-exec-1] [] [] o.s.w.s.DispatcherServlet | Completed initialization in 7 ms

i.e. I am only interested in displaying the "line" data, to make it easier to read through the logs

Cheers.

[gcusello]

Hi gentcore,
do you want to display or to index the event in this way ?
if you want to display the event in this way, you can use a regex like this:

your_search
| rex "\{\s+\[-\]\s*line:\s+(?<my_log>[^\}]*)"
| table _time my_log

If instead you want to index only this part of event and discard the rest, you have to insert in your props.conf, in the stanza of this sourcetype:

SEDCMD-my_log = s/\{\s+\[-\]\s*line:\s+//g

You can test the regex at https://regex101.com/r/AZsiou/1 .

Bye.
Giuseppe