Hi
I have a question about a rex with multiple outputs. I use rex to get two fields out of the source-path to fill them into a new field.
The complete source for Weblogic is /appl/midw/wls/<midw_appl>/<midw_node>/<midw_appl>/pf-midw/logs/gc.log
.
For Tomcat the secound directory 'midw_appl' is not used: /appl/midw/tc/<midw_appl>/<midw_node>/pf-midw/logs/gc.log
We can use rex field=source /appl/midw/"(wls|tc)"/(?<midw_appl>\w+.*)/(?<midw_node>\w+.*)/.*/pf-midw/logs/gc.log
to get Weblogic corretly and rex field=source /appl/midw/"(wls|tc)"/(?<midw_appl>\w+.*)/(?<midw_node>\w+.*)/pf-midw/logs/gc.log
to get Tomcat correctly.
So, I am searching for a solution e.g. to start rex matching at the beginning of the source field or a way to stop the first output at /
to get both of them.
I would be pleased if anybody have an good idea for this issue!
Thanks and best regards,
Fritz
The answer in this case is:
rex field=source (\/\w+){3}\/(?
The answer in this case is:
rex field=source (\/\w+){3}\/(?