I have a collection of log files that I am trying to parse.
From Apache/Tomcat using logback
I don't have permission to change the layout of the log files at the moment but can work on that
Event field from the quick parse seems to hold a lot of data that could be separated out into "Fields" via comma separation.
I seem to need the 3rd item in Event if we could parse them by comma
Is there an easy way to do that in the query syntax?
The Event section looks like:
date, something about a filter, THE URL THAT I WANT, other junk etc
2022-05-01 23:15:24, calling SSO: null, /topUrl/rest/services/folder/servicename/command?moreinfoEtc, referer: Null, request ip: 10.xxx.xxx.xxx
So, I'd love to get statistics on
Any help would be great.