How to extract the two fields from the message ?
In this need to extract after API: START: /v1/expense/extract/demand/
nagl as one field .
demand _con.csv in another field
I am extracting
|rex field=message max_match=0 "API: START: /v1/expense/extract/odemand/ (?<OnDemandFileName>[^\n]\w+\S+)"
API: START: /v1/expense/extract/demand/nagl/demand_con.csv
Hi @karthi2809,
if the first field is called app and the second is called OnDemandFileName, you can use this regex:
|rex field=message max_match=0 "API: START: \/v1\/expense\/extract\/demand\/(?<app>[^\/]+)\/(?<OnDemandFileName>.*)"
that you can test at https://regex101.com/r/uifAqM/1
Ciao.
Giuseppe
Try something like this
|rex field=message max_match=0 "API: START: /v1/expense/extract/demand/(?<oneField>[^\/]+)\/(?<anotherField>\S+)"
Working 👍
Hi @karthi2809,
if the first field is called app and the second is called OnDemandFileName, you can use this regex:
|rex field=message max_match=0 "API: START: \/v1\/expense\/extract\/demand\/(?<app>[^\/]+)\/(?<OnDemandFileName>.*)"
that you can test at https://regex101.com/r/uifAqM/1
Ciao.
Giuseppe