rex to extract a field

[Mohsin123]

How do I extract connection attempt failed from the below log

2017-12-20T07:51:05.847Z I REPL [ReplicationExecutor] Error in heartbeat request to 10.78.33.13:8191; Location18915 Failed attempt to connect to 10.78.33.13:8191; couldn't connect to server 10.78.33.13:8191 (10.78.33.13), connection attempt failed

[nickhills]

try this:
(?<err_message>Error.+;).+,(?<err_reason>.+)

It will extract two fields - err_message and err_reason

[gcusello]

Hi shraddhamuduli,
which information do you want to extract?
if you want to extract the message "connection attempt failed", it's easy

| rex ".*\),(?<my_field>.*)$"

if you want to extract other fields (e.g. server and port failed), it's

| rex ".*server\s(?<ip>\d+\.\d+\.\d+\.\d+):(?<port>\d+)"

Bye.
Giuseppe

[harsmarvania57]

Hi,

Can you please try <yourBasesearch> | rex ".*,\s(?<status>.*)", this will extract connection attempt failed in new field called status