I did not anticipate I'd struggle this much for what seemed like such a simple task.
The logs I am trying to parse have all sorts of crap sandwiched into [brackets].
Examples:
[thread] [timestamp] [transactionID] logLevel {moreNonsense}
[thread] [timestamp] logLevel [transactionID] {moreNonsense}
I want the logLevel. To say, I want all the text after the last occurrence of ]
, but before the first occurrence of }
Using regular expressions, how can I state to only return the string following that last ]
. There is no consistency in the character length or type of each bracketed field, there is also a variable number of bracket sets in each event, prior to the logLevel (2, 3 or 4 sets, dependent on the log source).
Each attempt I have made has yielded a logLevel value of everything following the very first closed bracket ]
If log_level can be multiple words, use this
.*\]\s*(?<log_level>[^\{]+)
OR if it is always single word, use this
.*\]\s*(?<log_level>\w+)\s*\{
OR if log_level is a finite list, try this
(?<log_level>INFO|WARN|DEBUG|CRITICAL)
What about this:
your base search
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"
Example 1:
| stats count | fields - count
| eval _raw = "[thread] [timestamp] [transactionID] LOGLEVEL1 {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"
Output:
logLevel = LOGLEVEL1
Example 2:
| stats count | fields - count
| eval _raw = "[thread] [timestamp] LOGLEVEL2 [transactionID] {moreNonsense}"
| rex "(\[[^\]]+\]\s?)+(?<logLevel>\w+)"
Output:
logLevel = LOGLEVEL2
If log_level can be multiple words, use this
.*\]\s*(?<log_level>[^\{]+)
OR if it is always single word, use this
.*\]\s*(?<log_level>\w+)\s*\{
OR if log_level is a finite list, try this
(?<log_level>INFO|WARN|DEBUG|CRITICAL)