I’m sure I just have something misconfigured, but I can’t seem to get one of my REGEX extractors working. I am able to get one working with no issues, so I think I understand the basic concept, but I obviously don’t understand something!
Here is a screenshot of my extractor configuration. The example message is an extremely common value. We are trying to group requests based on resource to audit how often certain paths are hit, and we want to group by the top level resource.
So in addition to not seeing the new field in any of my messages, I also noticed that everything “misses”, though I can’t find exactly what that means. I have tried extracting the regex against every message instead of filtering (on regex), and that seemed to have no effect either.
I can’t post a second screenshot, but my other regex extractor works great, and I thought maybe only the first matching extractor would run, but changing the order didn’t do anything. I assume all extractors run, but that is something else I tried. Also to clarify, my other extractor works on a different field and is also a copy, not cut operation. Here are the details for the failing extractor.
Metrics 279,345 total invocations since boot, averages: 132.77, 65.17, 60.08. 0 hits, 279345 misses Total time 95th percentile: 13μs 98th percentile: 54μs 99th percentile: 91μs Standard deviation: 1,544μs Mean: 67μs Minimum: 5μs Maximum: 48,990μs Condition time 95th percentile: 1μs 98th percentile: 1μs 99th percentile: 1μs Standard deviation: 2μs Mean: 1μs Minimum: 0μs Maximum: 44μs Execution time 95th percentile: 0μs 98th percentile: 0μs 99th percentile: 0μs Standard deviation: 0μs Mean: 0μs Minimum: 0μs Maximum: 0μs Converter time 95th percentile: 0μs 98th percentile: 0μs 99th percentile: 0μs Standard deviation: 0μs Mean: 0μs Minimum: 0μs Maximum: 0μs
So basically I am failing to understand why the tests on the configuration page say that it will extract my data, but then in the wild it is not appearing to do anything at all.
I’m not sure exactly what other information would be useful, but I’d be happy to provide anything I can.