{"timestamp":"2021-02-24T00:00:46.533+00:00","message":"Snapshot event published: SnapshotEvent(status=CREATED, version=SnapshotVersion(sourceSystem=zvkk, source=sdp/deposits/zvkk/2021-02-24/NextBusinessDays/Snapshot1, entityType=NEXT_BUSINESS_DAYS, date=2021-02-24, version=1, snapshotSize=5, uuid=8683aa33-3a6c-4087-9cdd-3084d8e70147, holiday=false))","component":"com.db.sdda.dc.kafka.service.SnapshotEventNotifyService","thread":"scheduling-1","level":"INFO"}   {"timestamp":"2021-02-23T20:56:37.797+00:00","message":"Snapshot event published: SnapshotEvent(status=CREATED, version=SnapshotVersion(sourceSystem=IDMS-0781, source=sdp/deposits/IDMS-0781/2021-02-23/FacilityLimit/Snapshot1, entityType=FACILITY, date=2021-02-23, version=1, snapshotSize=15168, uuid=016cc1ad-8c27-4144-a9d2-c0233cc1e450, holiday=false))","component":"com.db.sdda.dc.kafka.service.SnapshotEventNotifyService","thread":"scheduling-1","level":"INFO"}   Used command below  |rex field=_raw "sourceSystem=(?<So1>\w+[-]\w+)"    --> Able to get IDMS-0781 as a output but unable to get single word branch like zvkk  |rex field=_raw "sourceSystem=(?<So2>\w+)" Problem Statement 1.I would like to extract sourcesystem in way everything before comma (SourceSystem=IDMS-0781,) 2.Or both with hyphen and without hyphen should pick by rex command    ... View more