Want to extract "component","environment" & "componentType" and there corresponding value in table format.

[JyotiP]

I have the following log output and I want to extract "component", "environment" & "component type" and their corresponding value in table format.

Level="INFO", Date="2019-07-22 08:43:44,141", Message="{"Protocol":"https","Path":"/api/infrastructure/qualitygate/v1/qualityGateStatus","Verb":"GET","QueryParams":{"component":"help-website-stack","version":"1.0.291","environment":"testenvironment","componentType":"stack"},"body":{},"StatusCode":200,"Details":{"component":"help-website-stack","version":"1.0.291","sonarStatus":true,"integrationTestStatus":true,"status":true,"message":"","coverage":"0.0","newCoverage":"0.0"}}

[JyotiP]

@vnravikumar why .+ why not ',' ?

[JyotiP]

@vnravikumar I want to include also the newCoverage into the table. And I am using .+\"newCoverage\":\"(?P[^\"]+. I am able to retrieve the result but when the value for
newCoverage is null/blank it is not retrieving anything. What shall I do?

[vnravikumar]

Hi

Try the below method, as per your sample data Message are in JSON format. so I used spath to extract the info

[updated:]

| makeresults 
 | eval test="Level=\"INFO\", Date=\"2019-07-22 08:43:44,141\", Message=\"{\"Protocol\":\"https\",\"Path\":\"/api/infrastructure/qualitygate/v1/qualityGateStatus\",\"Verb\":\"GET\",\"QueryParams\":{\"component\":\"help-website-stack\",\"version\":\"1.0.291\",\"environment\":\"testenvironment\",\"componentType\":\"stack\"},\"body\":{},\"StatusCode\":200,\"Details\":{\"component\":\"help-website-stack\",\"version\":\"1.0.291\",\"sonarStatus\":true,\"integrationTestStatus\":true,\"status\":true,\"message\":\"\",\"coverage\":\"0.0\",\"newCoverage\":\"0.0\"}}" 
 | rex field=test "Message\=\"(?P<Message>.*)}}$" 
 | spath input=Message path=QueryParams.component output="Component" 
 | spath input=Message path=QueryParams.environment output="Environment" 
 | spath input=Message path=QueryParams.componentType output="Component Type" 
 | spath input=Message path=Details.newCoverage output="New Coverage" 
 | table Component Environment "Component Type" "New Coverage"

[vnravikumar]

As per your sample data, the version field was in-between component and environment to skip that I had used .+

[JyotiP]

Oh got it, make sense as well.

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval test="Level=\"INFO\", Date=\"2019-07-22 08:43:44,141\", Message=\"{\"Protocol\":\"https\",\"Path\":\"/api/infrastructure/qualitygate/v1/qualityGateStatus\",\"Verb\":\"GET\",\"QueryParams\":{\"component\":\"help-website-stack\",\"version\":\"1.0.291\",\"environment\":\"testenvironment\",\"componentType\":\"stack\"},\"body\":{},\"StatusCode\":200,\"Details\":{\"component\":\"help-website-stack\",\"version\":\"1.0.291\",\"sonarStatus\":true,\"integrationTestStatus\":true,\"status\":true,\"message\":\"\",\"coverage\":\"0.0\",\"newCoverage\":\"0.0\"}}" 
| rex field=test "\{\"component\"\:\"(?P<Component>[^\",]+).+\"environment\"\:\"(?P<Environment>[^,]+)\",\"componentType\"\:\"(?P<ComponentType>[^\"\}]+)" 
| table Component,Environment,ComponentType