How to select the last number of log entries using DPL

[alibasharat]

Hello team,

I have a use case where I am trying to capture the status code from the log entries using DPL. 

Please take a look at this log entry:

https://c***.c***v.aws.*****.com/ cn-***.***.aws.***.com 200 0 0 313 4837 210 10.3.7.508

I am trying to capture the status code 200 from the above log entry. The condition which i can think of is that from the last .com capture 3 digits integer. 

Note: Please keep in mind that the logs are not one single line. They are huge entries and the status code is always on the last line including the IP address, etc.. 

[sinisa_zubic · Accepted solution]

Hi @alibasharat 

Please try following pattern

DATA{0,10000} (<<'.com ' INT:statuscode)

Best,
Sini

[alibasharat]

Thank you Sini.