Using multiple REGEX for extracting a single field

[splunker12er]

I want to extract fields from a customized log (no pre-defined/standard log structure)

I do need to extract a field name "Description" where it has its appropriate values at different locations in various events.
Using multilple REGEX alone I can able to locate the values.

Can i use multiple REGEX to extract a single field ?

My config files:

props.conf

[myprops]
REPORT-Description = extract_desc

transforms.conf

[extract_desc]
REGEX = (,DESC,)
REGEX = (\((\d|)\))
FORMAT = Description::$1
FORMAT = Description::$2

I am trying to achieve as above , Is this correct way ?

[landen99]

I really have no idea what your logs look like, but from your description, they may have the form:

...,DESC,(1),...

In which case the following props.conf regex will catch it if the value is always digits:

EXTRACT-foo=,DESC,\((?P<Description>\d*)

There is no need for transforms unless there are multiple values of "Description" in a single event, or you also need to extract the field value from each event because it changes.
Also, there can only be one regex per transforms entry, even though that one regex may extract multiple fields.

[martin_mueller]

You can use multiple regular expressions to extract one field from differently structured events... but not like that. You can for example put two EXTRACT-foo lines into your props.conf that each extract the same field name.

Do post some sample data.