rex command to extract

[sphiwee]

[2020-07-07 12:40:01+0200] workspace_sandbox RUNNING pid 17159, uptime 21 days, 21:43:58

i have this line of log but i want to extract only workspace_sandbox as a field called Services

im using rex "(^(?<Service>\s\s\w+.\w+))\s\s" but having no luck. 

Also want to extract "Running" as status

[to4kawa]

| rex "\]\s(?<Service>\S+) (?<status>\S+)"

[sphiwee]

sphiwee_0-1594122964722.png

This is what i get, dont think it has to be like this.. any ideas?

[gcusello · Accepted solution]

Hi @sphiwee ,

please, try this

| rex "\]\s+(?<service>[^ ]+)\s+(?<status>[^ ]+)"

that you can test at https://regex101.com/r/ursNeq/1

Ciao.

Giuseppe

[sphiwee]

thanks, you're a legend.

[gcusello]

Hi @sphiwee ,

You're welcome!

Karma Points are appreciated.

Ciao.

Giuseppe