Definitely.
Try this instead of the rex
| rename _raw as raw
| rename logMessage as _raw
| extract kvdelim=":" pairdelim="~"
| rename _raw as logMessage
| rename raw as _raw
Please check (and correct if necessary) the formatting of the second example, for instance, in the first example, the colon (:) sometimes has a space after and sometimes before as well. Since spaces are used in your pattern matching, it is important to get this as accurate as possible.
Thank you, I looked into the formatting of the spaces. In the second event, there is no space between backendIdentifier and GFEDCBA-UUU, ceoCompanyId and EDCBA222, SOURCE_SYSTEM and SOURC1. There is a space between 'ERP_CLIENT:' and 'true'
logMessage: backendIdentifier:GFEDCBA-UUU ~ ceoCompanyId:EDCBA222 ~ SOURCE_SYSTEM:SOURC1 ~ ERP_CLIENT: true
In the first example, there a space before and after these words:
logMessage: ceoCompanyId : ABCDE111 ~ SOURCE_SYSTEM : SOURC1 ~ ERP_CLIENT: true
Do you think this may have an effect on the missing result?
Definitely.
Try this instead of the rex
| rename _raw as raw
| rename logMessage as _raw
| extract kvdelim=":" pairdelim="~"
| rename _raw as logMessage
| rename raw as _raw
Excellent. That worked prefect! Thank you very much!