How to write a regular expression to extract this 3 digit number from my sample events?

[JoshuaJohn]

I have these statements I am trying to extract the "200" from, but this number could be any three digit number though.

<117>Sep 01 16:19:12 ip-10-255-55-21 SLAVE[prodr35e-core_24322]: 10-255-55-21 10-255-55-21 - 2016-09-01 16:19:12 86 GET /search?keyword=true&sortKey=4&start=2100&count=s=false&marketPlace=true HTTP/1.1 ?keyword=true&sortKey=4&start=2100&count=60&s=false&marketPlace=true 200 33687 "Jak Commons-HttpClient/3.1"

<117>Sep 01 16:19:12 ip-10-444-33-63 SLAVE[prodr35e-core_390959]: 10-444-33-634 10-444-33-65 - 2016-09-01 16:19:12 2 GET /index.html HTTP/1.0 200 1488 "-"

<117>Sep 01 16:19:12 ip-10-999-39-99 SLAVE[prodr35e-core_390959]: 10.999.39.79 10.999.39.99 - 2016-09-01 16:19:12 252 GET /search?keyword=true&count=0&sendRefinements=false&marketPlace=true&isBOPUS=true&storeId=555&storeId=592&storeId=696&storeId=548&storeId=592 HTTP/1.1 ?keyword=true&count=0&sendRefinements=false&marketPlace=true&isBOPUS=true&storeId=555&storeId=592&storeId=696&storeId=548&storeId=592 200 973 "Jak Commons-HttpClient/3.1"

<117>Sep 01 16:19:12 ip-10-200-00-00 SLAVE[prodr35e-core_489352]: 127.0.0.1 10.200.00.00 - 2016-09-01 16:19:12 0 GET /products/admin/beans?key=/select&stats=true&cat=QUERYHANDLER&wt=json HTTP/1.1 ?key=/select&stats=true&cat=QUERYHANDLER&wt=json 200 733 "Python-urllib/2.7"

<117>Sep 01 16:19:12 ip-10-204-38-110 SLAVE[prodr35e-core_497105]: 10.222.22.22 10.222.22.222 - 2016-09-01 16:19:12 41 GET /search?&count=96&start=0&ltl=false HTTP/1.1 ?count=96&start=0&ltl=false 200 6903 "Java/1.7.0_55"

I just can't seem to get my regex to work for all of these statements, help would be highly appreciated!

[vanderhoff]

regex might not be what you want to use, You have several 3 digit numbers, however it seems like the data is all of a uniform format with spaces between fields. Using split you could do

eval temp=split(_raw," ") | eval status=mvindex(temp,15) | fields - temp

[inventsekar]

your search | rex field=_raw "\s(?<response>\d\d\d[^\s])" | table response

[sundareshr · Accepted solution]

Try this

... | rex "\s(?<status>\d\d\d)\s" | table status