I have below log:
Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure
Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure
and would like to catch with RegEx:
a: 365.45.1.87.3.60354 b: remote.234.5
a: remote.567.9 b: remote.284.9
Thanks for help
Hi @dabroma5
try this regex:
| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"
that you can test at https://regex101.com/r/fOwXfs/1
if eventually you have some false positive, you could also try:
| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"
that you can test at https://regex101.com/r/fOwXfs/2
Ciao.
Giuseppe
Hi @dabroma5
try this regex:
| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"
that you can test at https://regex101.com/r/fOwXfs/1
if eventually you have some false positive, you could also try:
| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"
that you can test at https://regex101.com/r/fOwXfs/2
Ciao.
Giuseppe
@gcusello your response was crazy fast! Awesome!
Hi @dabroma5
you're welcome!
Ciao and next time.
Giuseppe
Hi
Check this
| makeresults
| eval log="Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure#Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure"
| eval temp=split(log,"#")
| mvexpand temp
| rex field=temp "\:\s+(?P<a>[^->]+)\s+->\s+(?P<b>\S+)"
| table a b