extract a matching string into field

[shanyour]

I have an event with a text spans over multiple lines. it has no key-value pattern. the body string has a uuid value. I want to extract only the uuid value into a field named uuid and dispaly them in | table time uuid row

ex.

2016/07/02 11:23:45 error nullpointerexception 123ACA12:2345:6785:DEF1:123890AB12345678 at line number 171

[somesoni2]

Give this a try

your base search | rex "(?<uuid>[0-9:A-z\r\n]+) at line number (?<row>\d+)" | table _time uuid row

https://regex101.com/r/HoJEl2/1