Dear all,
hope to find here some help.
I've tried now several things including searching in the answers here but don't find the solution.
I've for example a log file that is structured like that
<?xml version="1.0" encoding="UTF-8"?>
<PublishLog Version="5.0">
<RequestReport>
<Request>
<Id>Z00000hyjlq1l4Xpa3Z53MZbem7cZ</Id>
<StartTime>1407386816620</StartTime>
<User>
[email protected]</User>
<Type>ps_publish</Type>
<RequestTime>1407386816587</RequestTime>
<RequestMsg/>
<Description>cli for user
[email protected]</Description>
<ClientData/>
<Result>FLR</Result>
<EndTime>1407387275454</EndTime>
</Request>
<Replies>
<ReplyFirst>
<Time>1407386816719</Time>
<Result>ACK</Result>
<RequestId>Z00000hyjlq1l4Xpa3Z53MZbem7cZ</RequestId>
</ReplyFirst>
<ReplyLast>
<Time>1407387275454</Time>
<Result>FLR</Result>
<ResultNlMsg>
<NlMsgId>BMC-IPS000206I</NlMsgId>
</ResultNlMsg>
</ReplyLast>
</Replies>
</RequestReport>
....
With the rex expression
`rex field=_raw ".*FLR</Result>\s+<EndTime>(?<EndTime>.*?)</EndTime>"`
I get the EndTime value. No problem.
But now I want to search to the first FLR and then to the <NlMsgId>
`rex field=_raw ".*FLR</Result>[WHATISMISSINGHERE??]<NlMsgId>(?<BMCI>.*?)</NlMsgId>"`
What I've to set for a regular expression that it leaves out the text between
`FLR</Result>`
and
`<NlMsgId>`
?
I can't search directly for the <NlMsgId> because there are also other before the not listed text.
I've tried star and a lot of other things with no success 😞
Also does someone has some hints where to best start so I get more familar with those regular expressions?
Thanks a lot and cheers
Markus
... View more
