hi i have log file like below
need to extact the section after first "]" to "[" or "." or ":"
2020-04-24 23:59:59,511 INFO ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']
expected value:
Thanks
Use rex:
index = INDEX | rex "\]\s(?<message>[\w\s]+)"
Sample query:
| makeresults
| eval _raw=" _raw
2020-04-24 23:59:59,511 INFO ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']"
| multikv forceheader=1
| rex "\]\s(?<message>[\w\s]+)"
| fields _raw, message
Use rex:
index = INDEX | rex "\]\s(?<message>[\w\s]+)"
Sample query:
| makeresults
| eval _raw=" _raw
2020-04-24 23:59:59,511 INFO ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']"
| multikv forceheader=1
| rex "\]\s(?<message>[\w\s]+)"
| fields _raw, message
work like charm, thank you 😉