I have the following log message inside LogZ and I'd like to trim it before forwarding it as an alarm:
[ {
"message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:08Z\"}\n"
}, {
"message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:06Z\"}\n"
}, {
"message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:05Z\"}\n"
} ]
Since LogZ (Kibana) supports Regex, the main idea was to remove everything besides the reason
field with the message it carries. So is there anyway I can use regex to end with the following message?:
reason: Error while unmarshalling the incoming data. Likely due to formats mismatch
CodePudding user response:
Sure you can do it using positive look behind
from string reason\":\"
and extract all character behind it until \
.