Rex to filter To remove multiline log entry

[Tijil480]

Please find the below single Log entry with multiple lines:

>Validation results 

   Message 1) sucess: true 

   Message 2) sucess: false 

   Reason : All is an invalid log event type 

   Message 3) sucess: true 

......

Need rex to fetch only false with reason lines.

Remaining needs to be ignored.

Tried below rex not getting proper results.

|Rex field=_raw "(?ms)(?<result>(.*)(?:true)"|table result

[richgalloway]

Try this

| rex "(?<result>false[\s\S]*)Message"
| table result

[Tijil480]

Still it fetches sucess: true 

[richgalloway]

regex101.com disagrees. https://regex101.com/r/deZogv/1

[ITWhisperer]

To just get the reason:

| rex "(?ms)sucess: false[^\n]\n(?<field>[^\n]+)"

To get both lines:

| rex "(?ms)(?<field>[^\n]+sucess: false[^\n]+\n[^\n]+)"

[Tijil480]

Both queries are not returning any reaults

[ITWhisperer]

Perhaps if you could share some more realistic log data (anonymised of course) it might help us work out what may be going wrong

[ITWhisperer]

Did you try this?