Hello,
I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request :
index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex field=_raw (?<URL>https?:\/\/\S+)
but I want to stop to the first "/" with this one, then I have an error message :
index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex (?<url>https?:\/\\[^:\/]+)
Error => Error in 'SearchParser': Missing a search command before '^'. Error at position '75' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.
Could you help me please ?
Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.
It should be like:
| rex "(?<url>https?:\/\/[^:\/]+)"
I've tested it and it seems to do what you are asking:
Regards,
J
Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.
It should be like:
| rex "(?<url>https?:\/\/[^:\/]+)"
I've tested it and it seems to do what you are asking:
Regards,
J
It works, thank you !