How to write a regular expression for my use case?

[sravankaripe]

11-01-2016 14:53:32.199 -0500 INFO  StreamedSearch - Streamed search connection terminated: search.......................

11-01-2016 15:01:31.638 -0500 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event....................

i have a use case to display the messages for all log levels. Please help me in writing the rex for this case.

[somesoni2 · Accepted solution]

Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try

your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"

[ddrillic]

A similar request at Search time indexing failing with certain field name

[skoelpin]

Try this

Base Search | rex (?P<Messages>(?<=INFO|WARN).+\B)