multiple output rex with a directory sometimes exists

[fritzsplunk]

Hi

I have a question about a rex with multiple outputs. I use rex to get two fields out of the source-path to fill them into a new field.

The complete source for Weblogic is /appl/midw/wls/<midw_appl>/<midw_node>/<midw_appl>/pf-midw/logs/gc.log.
For Tomcat the secound directory 'midw_appl' is not used: /appl/midw/tc/<midw_appl>/<midw_node>/pf-midw/logs/gc.log

We can use rex field=source /appl/midw/"(wls|tc)"/(?<midw_appl>\w+.*)/(?<midw_node>\w+.*)/.*/pf-midw/logs/gc.log to get Weblogic corretly and rex field=source /appl/midw/"(wls|tc)"/(?<midw_appl>\w+.*)/(?<midw_node>\w+.*)/pf-midw/logs/gc.log to get Tomcat correctly.

So, I am searching for a solution e.g. to start rex matching at the beginning of the source field or a way to stop the first output at / to get both of them.

I would be pleased if anybody have an good idea for this issue!

Thanks and best regards,
Fritz

[fritzsplunk · Accepted solution]

The answer in this case is:
rex field=source (\/\w+){3}\/(?"[a-zA-Z0-9-]"+)\/(?"[a-zA-Z0-9-]"+)\S+