I'm trying to write to write a search to extract a couple of fields using rex. The text string to search is: "SG:G006 Consumer:CG-900004_T01 Topic:ingressTopic Session: bc77465b-55fb-46bf-8ca1-571d1ce6d5c5 LatestOffset:1916164 EarliestOffset:0 CurrentOffset:1916163 MessagesToConsume:2" I trying the following but nothing gets returned: index=... | rex "MessagesToConsume:(?P<MessagesToConsume>\d+) CurrentOffset:(?P<CurrentOffset>\d+)" | where MessagesToConsume>1 | table CurrentOffset MessagesToConsume CurrentOffset and MessagesToConsume are always empty, what am I doing wrong? Thanks!
... View more