Hi Team,
Need help to extract fields for the following. Please help rex for the below.
'ConnID' '007202761fdb2c01'
'VirtualQueue' 'ABC_EFG_BJFNKJFN'
If these are single line events:
\'ConnID\'\s+\'(?<ConnID>[^\']+)'
And
\'VirtualQueue\'\s+\'(?<VirtualQueue>[^\']+)'
Multiline events are a bit different. You need to make sure that the events are process properly as multiline, then you can do something like..
(?m) \'ConnID\'\s+\'(?<ConnID>[^\']+)'\n\'VirtualQueue\'\s+\'(?<VirtualQueue>[^']+)'
If these are single line events:
\'ConnID\'\s+\'(?<ConnID>[^\']+)'
And
\'VirtualQueue\'\s+\'(?<VirtualQueue>[^\']+)'
Multiline events are a bit different. You need to make sure that the events are process properly as multiline, then you can do something like..
(?m) \'ConnID\'\s+\'(?<ConnID>[^\']+)'\n\'VirtualQueue\'\s+\'(?<VirtualQueue>[^']+)'
Is that the full event? Which part are you trying to extract? What are the names of the fields here?
@rishiaggarwal , Is that the full event ? Also please clarify what you want to extract