extract http response code

[praveenvvn]

I have events consisting of a msg field with data like below:

dev.scurry.com - [2020-01-05T19:08:10.7658789Z] "PUT /case-pst/msging/eith/TNT/2020-01-05/blob/tenthouse.txt HTTP/1.1" 200 0 61814 "-" "-" "182.236.164.11:25412" "182.236.0.0:12001" x_forwarded_for:"182.236.164.11, 182.236.164.11" x_forwarded_proto:"https" vcap_request_id:"asdf098a0-j453-8asdf8-876-8907asdf9087" response_time:0.079841 gorouter_time:0.000152 app_id:"asdf098a0-j453-8asdf8-876-8907asdf9087" app_index:"0" x_cf_routererror:"-" x_b3_traceid:"asdf098as78987" x_b3_spanid:"7a7sad9898d90khjk" x_b3_parentspanid:"-" q3:"7asdf987987asdf9-78968asfdklj"

I need to extract the http status code and only for PUT requests.

Am new to regex. Any advise or pointers.

Thanks.

[richgalloway · Accepted solution]

This should do it.

| rex field=msg "\\\"PUT [^\\\"]+\\\" (?<errorCode>\d+)"