rex extract first string

[indeed_2000]

Hi

How can I extract first occured this "User ABC123 invalid"  with rex?

Here is the log:

2021-10-03 13:26:44,441 ERROR [APP] User ABC123 invalid: javax.security.auth.login.LoginException: User ABC123 invalid

Thanks,

[gcusello]

Hi @indeed_2000,

if your want to extract the message after "LoginException", you could use the following regex:

| rex "LoginException:\s+(?<message>.*)"

that you can test at https://regex101.com/r/Gz7glo/1

Ciao.

Giuseppe

[ITWhisperer]

Doesn't this give the second occurrence not the first?

[ITWhisperer · Accepted solution]

| rex "\]\s(?<error>[^:]+):"