I am trying to extract something like below
event1.epochtime=1282182111 type=type1 value=value1 type=type3 value=value3
REPORT-type = mv-type
REGEX = type=(?type\s+)
MV_ADD = true
Now when I restart after above , I still see only one value in type, so result is type=type1 only . May I know what I am doing wrong ?
S in your REGEX instead of small case.
REGEX = type=(?<type>\S+)
See the comment from @Daljeanis at the bottom on the documentation.
Can you please try below configuration?
[test] REPORT-type = mv-type
[mv-type] REGEX = type=(?<type>[^\s+]*) MV_ADD = true
Well it works , I should have seen the comment which was mentioned at the below of the document . So it was the regex problem . Thanks for your response man