Use parse regex on the whole ingest log
Hello! Very new to SumoLogic, but have good programing skills.
When using multiple Parse Regex operators in a row, I notice that consecutive operators try to find data within the first operator's _message. For example,
| parse regex "Recent\\(?<protocol>.*?)<\/td>"
| parse regex "Cycler:<\/B><\/td><td>(?<cyclerID>.*?)<\/td>"
| parse regex "TimeBegin:<\/B><\/td><td>(?<timeBegin>.*?)<\/td>"
| parse regex "TimeEnd:<\/B><\/td><td>(?<timeEnd>.*?)<\/td>"
All operators work on their own, but not together. Can I somehow use the other parses, but NOT within the result of the first?
Related to this, do I need to specify Processing Rules for Logs so that all this information is within one log message?
Thank you!
Please sign in to leave a comment.
Comments
0 comments