Hello,
I have an event like this:
2016-03-04 00:02:05,546 DEBUG [net.ussouth.aps.shared.util.SysLogUtil] fastcard Act dbservice 8a848b8d531f68940153400111f417ae 20160304 000206 ;0987789000000000= 0987789000000000= 0987789000000000 07675004668 840 5.0 Toys R Us 05927 TOYS 05927100 FCMS 087591 49 USD 59 0200 08759105927 TOYS.05927100 53746565 87077798 1 8a848b8d531f68940153400111f417ae false
and I'm using this regex to get some fields from it:
| rex "(?(\d{4}-\d{2}-\d{2} \d{2}\:\d{2}\:\d{2}\,\d{3})) (?DEBUG|INFO|WARN|ERROR) (?\[.*\]) (?.*)" | table timestamp, loglevel, origin, content
I can get all the fields ok except for **content** that is stopping when it finds a linebreak in the text. How can I make it get all the remaining text and set it in the (content) field?
Regards!
↧
How to edit my rex statement to ignore line breaks to extract the entire value for a certain field?
↧