issue in rex query

[roopeshetty]

Hi Guys,
I have a log as below;

server1;443 status= running.
server2;443 status= running.
server3;443 status= running.
server4;443 status= running.

In this I need to create a field by name “ServerName” by targeting all server names as its values example server1, server2, server3 etc.

I am running the rex query as below;
|rex "(?.*);443"

now i am getting the expected result but an additional text lines will be added onto its values as below;

Message=server1
Message=server2
Message=server3
Message=server4

Any idea from where this word “Message=” is being added to these values as prefix and how can we remove it?

[vnravikumar]

Hi @roopeshetty

Try with

^(?P<ServerName>.*);\d

[renjith_nair]

@roopeshetty ,

Looks like your group filed was removed from the question. Try to add code formatting whenever you add search strings.

Nevertheless, try this

rex "(?<server>.+);443"