11-01-2016 14:53:32.199 -0500 INFO StreamedSearch - Streamed search connection terminated: search.......................
11-01-2016 15:01:31.638 -0500 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event....................
i have a use case to display the messages for all log levels. Please help me in writing the rex for this case.
Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try
your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"
Assuming the location of log_level field is fixed in your events (after timestamp), then give this a try
your base search | rex "^(\S+\s+){3}(?<log_level>\S+)"
A similar request at Search time indexing failing with certain field name
Try this
Base Search | rex (?P<Messages>(?<=INFO|WARN).+\B)