I'm trying to extract 2 fields from a transacted search, one for the max and one for the usage.
2015-03-12 12:10:11,180 INFO metrics - type=GAUGE, name=heap.max, value=1908408320
2015-03-12 12:10:11,181 INFO metrics - type=GAUGE, name=heap.used, value=82831232
I have solved this by using;
rex field=_raw "name=heap.max, value=(?<Max>\S+)" | rex field=_raw "name=heap.used, value=(?<Used>\S+)"
View solution in original post