How to list content between two strings from RAW text?

[akapoor47]

Here is the raw text - 

com.companyname.package: stringstart e-38049e11-72b7-4968-b575-ecaa86f54e02 stringend for some.datahere with status FAILED, Yarn appId application_687987, Yarn state FINISHED, and Yarn finalStatus FAILED with root cause: samppleDatahere: com.packagenamehere: Forbidden (Service: Amazon S3; Status Code: 403; Error Code: 403 Forbidden; Request ID: sjhdjksdn; 

Need to list down the uuid which is in between stringstart and stringend 

[PickleRick]

Well, you need to simply find something between your "anchors". Which in simplest form might just be

stringstart\s(?<uuid>.*)\sstringend

If you know that the uuid has some particular form you can be a bit more specific (for example not to capture wrongly formed uuid)

stringstart\s(?<uuid>[0-9a-f]-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12})\sstringend

You can even add more anchoring text in front or at the end if you have more constant parts.

So as you have a regex matching and extracting this part, you can - depending on your use case - either use it as @marnall showed with rex command or use it to define a search-time extraction. For example

EXTRACT-uuid = stringstart\s(?<uuid>[0-9a-f]-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12})\sstringend

[marnall]

I am not sure specifically what you want to do, but if you have that _raw data in an event, and you would like to extract the uuid into a field, then you can make a regex with a named capture group in the rex command to extract it during search time. If you would like this to be permanent then you can copy the regex into a Field Extraction.

<yoursearch>
| rex field=_raw "com.companyname.package: (stringstart\s)?(?<uuid>\S+) (stringend )?for"

I made the assumptions that there are no space characters in the uuid string, and that it is surrounded by "com.companyname.package: and "for"