Rex Field

[jwursteisen]

...

[ITWhisperer]

Please check (and correct if necessary) the formatting of the second example, for instance, in the first example, the colon (:) sometimes has a space after and sometimes before as well. Since spaces are used in your pattern matching, it is important to get this as accurate as possible.

[jwursteisen]

Thank you, I looked into the formatting of the spaces. In the second event, there is no space between backendIdentifier and GFEDCBA-UUU, ceoCompanyId and EDCBA222, SOURCE_SYSTEM and SOURC1. There is a space between 'ERP_CLIENT:' and 'true'

logMessage: backendIdentifier:GFEDCBA-UUU ~ ceoCompanyId:EDCBA222 ~ SOURCE_SYSTEM:SOURC1 ~ ERP_CLIENT: true

 In the first example, there a space before and after these words:

logMessage: ceoCompanyId : ABCDE111 ~ SOURCE_SYSTEM : SOURC1 ~ ERP_CLIENT: true

Do you think this may have an effect on the missing result?

[ITWhisperer · Accepted solution]

Definitely.

Try this instead of the rex

| rename _raw as raw
| rename logMessage as _raw
| extract kvdelim=":" pairdelim="~"
| rename _raw as logMessage
| rename raw as _raw

[jwursteisen]

Excellent. That worked prefect!  Thank you very much!