how to extract from java.lang

[GreeshmaV]

My events look like this
TYP=ERR, TS1=1423574799157, TS2=1423574799157, CMP=PUR, EDESC=Unknown Host
java.lang.Exception: Validation failed: input param is NULL
LogClient.java:39)

How to extract from java.lang.Exception to the end of the event using regular expression

[thomrs]

Off the top of my head something like this

(?i)java.lang.Exception:\s?<field>(.+)$

[cpetterborg]

This works for my data (YMMV) at search time:

"java.lang.Exception" | rex field=_raw "(?ms)java.lang.Exception(?P<exception>.+)"

[thomrs]

add (?ms) on the beginning - the s is dotall, and the m is multi-line.

 (?ms)java.lang.Exception:\s?<field>(.+)

[GreeshmaV]

its multiline event

[richgalloway]

Is that the entire event? I ask because of the mis-matched paren. Is it a single-line or multi-line event?