Based on nittala answer: rex field=_raw "Caused\sby\:\s.+\.(?<ExceptionName>[^:]+):" This takes in consideration also an error that doesn't end with "Exception" word ... View more