Looking for a regex in 612,200(threadDuration) and 3(no.of.Threads) for the log message below...
WSVR0605W: Thread “WebContainer : 1” has been active for 612,000 milliseconds and may be hung. There are 3 threads in total in the server that may be hung.
Here's a regex that will extract the number of ms
The field is called Time
... | rex (?P<Time>(?<=been\sactive\sfor\s)\d+\,\d+(?=\smilliseconds))
Here's the regex for number of threads which the field is called Threads
... | rex (?P<Threads>(?<=There\sare\s)\d)
Here's a regex that will extract the number of ms
The field is called Time
... | rex (?P<Time>(?<=been\sactive\sfor\s)\d+\,\d+(?=\smilliseconds))
Here's the regex for number of threads which the field is called Threads
... | rex (?P<Threads>(?<=There\sare\s)\d)
This works on regex101.com with your sample event.
... | rex "for (?<threadDuration>[\d,]+).*?(?<threadCount>\d+) threads" | ...