Hi everyone, I have this log format in a Managed Cluster, with Log Classic, no Grail:
"content": "last access : Wed May 22 11:32:42 ART 2025\\nmax inactive interval : 1800\\nuser name : anonymous\\nvalid session : true\\nnew session : false\\noverflowed : false\\n _refCount=1\\n } \\n _httpSessionContext=com.ibm.ws.session.http.HttpSessionContextImpl@115c1a4a\\n } \\n)\\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,936 DEBUG script.dao.GeneralDAOImpl findRow(sp_FN_Comprobantes_FNC,{54672,1,50150346002250506,39,})\\nULL1lryN-ZidhtxVbFg09WN 28/05/25 11:32:50,936 DEBUG sam.service.SamSPService <<<< TM_FEMP_DB2. - RESULTADOS: cursor -> 1 items retornados, P_COD_CLASEORD = TXO, P_COD_CLIECASH = 0026008500002886, p_sqlcode_out = null, P_COD_IDORDEN = 5751BOJN, \\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,936 INFO script.dao.GeneralDAOImpl \\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,938 INFO script.dao.GeneralDAOImpl exec sp_FN_Comprobantes_FNC 54672, null, '50150346002250506', '39', null, null, null\\nc5uZNCXLKmuKjacR5_NNqxK 28/05/25 11:32:50,938 INFO script.dao.GeneralDAOImpl ",
I need to get the keyvalue string: c5uZNCXLKmuKjacR5_NNqxK (23 letters).
The keyvalue appears on multiple lines in the log, and there are even other keys with the same string length that I need to capture. It's always a 23-character string.
I can check after /n (newline) begins with the keyvalue but I cannot get the value with this filter:
PARSE(content, "LD '\n' DATA [a-zA-Z0-9_-]{23}:test")
Does anybody knows what is the correct filter to get the keyvalue? and is it possible to get multiple keyvalues from this content log?
Regards!
