Rex for different pattern of same fields within same event

[sh254087]

Trying to formulate a Regex that would work with events something like the below one. When I tried extracting the fields, I did not get to the expected output as the field name I'm looking at is same for values of different pattern. The rex was either failing or throwing error about using duplicate field name.

Sample Event entry:
No machines for project Print-Demo
No machines for project Kimkeen_POC
No machines for project Default Project
Project name: ABCD Life, Machine name:hlstocpra2, Status:STARTED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:HKWONDERSVD02, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:hlstocpraw2, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
No machines for project Print
No machines for project Demo2
No machines for project Test_migrate

Expected extraction and output:

Looking for help in extracting the fields with all the values to be presented in individual rows.

[wenthold]

I'm not sure if you should use a more complex single rex command, but you can:

| rex "[Pp]roject (?:name: )?(?<ProjectName>[^\,\r\n]+)(?:\, Machine name\:(?<MachineName>[^\,]+)\, Status\:(?<JobStatus>[^\,]+)\, Backlog bytes\:(?<BacklogBytes>[0-9]+)\, Last consistency\:(?<LastConsistency>.*))?"
| table ProjectName, MachineName, JobStatus, BacklogBytes, LastConsistency

[gcusello]

Hi sh254087,
I suggest to use two different regexes, one for No machines and one for machines the merge machine name fields using coalesce, in othe words:

| rex "(No machines for project )(?<Project_Name1>.*)"
| rex "(?ms)Project name: (?<Project_Name2>[^,]*), Machine name:(?<Machine_Name>[^,]*), Status:(?<Status>[^,]*), Backlog bytes:(?<Backlog_bytes>[^,]*)"
| eval Project_name=coalesce(Project_name1,Project_name2)

you can test it at https://regex101.com/r/X3pgrK/2

Bye.
Giuseppe

[sh254087]

Please help @niketnilay
@shwetas