Can someone assist extracting fields using the string below?
The first line is header info: date, protocol, response_status, response_type
each line following (one to many) is a website and an error code
i can't figure out a regex to capture the header line AND the successive lines of websites and error codes.
02-Mar-2021 UDP Response Found Response Type: ABCwww.site1.com 404www.site10.com 100www.site4.com 400.....
Thanks in Advance.
let me understand:
I'm reading a log file. this is a single event:
02-Mar-2021 UDP Response Status:Found Response Type:ABC www.site1.com 404 www.site10.com 100 www.site4.com 400
I'd like to create a regex/field extraction that captures all the fields below. website would be a multivalue field since there are multiple occurrences (one to many)
fields and valuesdate:02-Mar-2021protocol: UDPResponse status: FoundResponse Type: ABCwebsite: www.site1.comstatus: 404website: www.site10.comstatus: 100website: www.site4.comstatus: 400
you have to use two regexes:
the first to extract the header:
| rex "^(?<date>[^ ]+)\s+(?<protocol>\w+)\sResponse\s+(?<response_status>\w+).+Response\s+Type:\s+(?<response_type>\w+)"
that you can test at https://regex101.com/r/wP3LyX/1
the second to extract the sites:
| rex "(?<site>www\.[^ ]+)\s+(?<response_code>\d+)"
that you can test at https://regex101.com/r/UCwx2h/1