[2020-07-07 12:40:01+0200] workspace_sandbox RUNNING pid 17159, uptime 21 days, 21:43:58
i have this line of log but i want to extract only workspace_sandbox as a field called Services
im using rex "(^(?<Service>\s\s\w+.\w+))\s\s" but having no luck.
Also want to extract "Running" as status
Hi @sphiwee ,
please, try this
| rex "\]\s+(?<service>[^ ]+)\s+(?<status>[^ ]+)"
that you can test at https://regex101.com/r/ursNeq/1
Ciao.
Giuseppe
| rex "\]\s(?<Service>\S+) (?<status>\S+)"
This is what i get, dont think it has to be like this.. any ideas?
Hi @sphiwee ,
please, try this
| rex "\]\s+(?<service>[^ ]+)\s+(?<status>[^ ]+)"
that you can test at https://regex101.com/r/ursNeq/1
Ciao.
Giuseppe
thanks, you're a legend.