Hi,
Any thought off-hand as to what I'm not accounting for?
Looking to extract values from a field in unstructured logs.
Example event:
... { X-Request-Id:[<36_characters_of_interest>] .....
Was attempting to pull it from a named capture group (whose regex itself matches the correct characters), but no luck with any data showing up in the table.
index="k8s_events" real-estate-app X-Request-Id
| regex (?<x_request_id>(?<=X\-Request\-Id\:\[).............................................)
| table x_request_id
| rex "X\-Request\-Id\:\[(?<x_request_id>.{36})"
Thank you!!