What's Wrong With This Query?

[ahcarpenter]

Hi,

Any thought off-hand as to what I'm not accounting for?

Looking to extract values from a field in unstructured logs.

Example event:

... { X-Request-Id:[<36_characters_of_interest>] .....

Was attempting to pull it from a named capture group (whose regex itself matches the correct characters), but no luck with any data showing up in the table.

index="k8s_events" real-estate-app X-Request-Id
| regex (?<x_request_id>(?<=X\-Request\-Id\:\[).............................................)
| table x_request_id

[ITWhisperer · Accepted solution]

| rex "X\-Request\-Id\:\[(?<x_request_id>.{36})"

[ahcarpenter]

Thank you!!