I have a reliable base query to find events containing the information I want.
I built a rex using the field extractor, but applying the rex expression in a search does not yield any results, the values(gts_percent) column is always blank
Sample query:
index="june_analytics_logs_prod" $serial$ log_level=info message=*hardware_controller*|
rex field=message "(?=[^G]*(?:GTS weight:|G.*GTS weight:))^(?:[^\.\n]*\.){7}\d+\w+,\s+\w+:\s+(?P<gts_percent>\d+)"|
convert rmunit(gts_percent)|
chart values(gts_percent) by _time
Sample raw_ result :
{"bootcount":8,"device_id":"XXX","environment":"prod_walker","event_source":"appliance","event_type":"GENERIC","local_time":"2025-02-20T00:47:48.124-06:00",
"location":{"city":"XX","country":"XX","latitude":XXX,"longitude":XXX,"state":"XXX"},
"log_level":"info","message":"martini::hardware_controller: GTS weight: 17.05kg, tare weight: 8.1kg, net weight: 8.95kg, fill weight: 6.8kg, percent: 100%\u0000",
"model_number":"XXX","sequence":403659,"serial":"XXX","software_version":"2.3.0.276","ticks":0,"timestamp":1740034068,"timestamp_ms":1740034068124}
I am trying to extract the bold value in the raw, Where is my rex messing up?
The field extractor and erex commands tend to create overly complicated expressions. This one should work.
| rex field=message "percent: (?<gts_percent>\d+)"
The field extractor and erex commands tend to create overly complicated expressions. This one should work.
| rex field=message "percent: (?<gts_percent>\d+)"
this worked like a charm!
thank you!