Regex not workin

[man03359]

Hi All,

Here is my how my event looks like -

20/11/2023 12:47:05 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : NotAllowed ; Refusal Reason : message=MessageHeader.POIID: NotAllowed Value: P400Plus-805598742, Reason: my POIID is P400Plus-805598450 

I am trying to extract the part "POIID: NotAllowed Value: P400Plus-805598742, Reason: my POIID is P400Plus-805598450"

I am using this regex -

| rex field=_raw "MessageHeader.+(?<POIID_Error>)-*"

But the field vale POIID_Error seems to be blank after running the query.

Attaching the ss for reference.

man03359_0-1700565263533.png

Little suggestion to fix this is appreciated.

[ITWhisperer]

MessageHeader\.(?<POIID_Error>.+)

[man03359]

@ITWhisperer  

it seems to be working now , thanks a lot 🙂 🙂