Unable to get some REGEX extractors working

[InfernoTK (Tim)]

I’m sure I just have something misconfigured, but I can’t seem to get one of my REGEX extractors working. I am able to get one working with no issues, so I think I understand the basic concept, but I obviously don’t understand something!

Here is a screenshot of my extractor configuration. The example message is an extremely common value. We are trying to group requests based on resource to audit how often certain paths are hit, and we want to group by the top level resource.

So in addition to not seeing the new field in any of my messages, I also noticed that everything “misses”, though I can’t find exactly what that means. I have tried extracting the regex against every message instead of filtering (on regex), and that seemed to have no effect either.

I can’t post a second screenshot, but my other regex extractor works great, and I thought maybe only the first matching extractor would run, but changing the order didn’t do anything. I assume all extractors run, but that is something else I tried. Also to clarify, my other extractor works on a different field and is also a copy, not cut operation. Here are the details for the failing extractor.

Metrics
279,345 total invocations since boot, averages: 132.77, 65.17, 60.08.
0 hits, 279345 misses
Total time
95th percentile:
13μs
98th percentile:
54μs
99th percentile:
91μs
Standard deviation:
1,544μs
Mean:
67μs
Minimum:
5μs
Maximum:
48,990μs
Condition time
95th percentile:
1μs
98th percentile:
1μs
99th percentile:
1μs
Standard deviation:
2μs
Mean:
1μs
Minimum:
0μs
Maximum:
44μs
Execution time
95th percentile:
0μs
98th percentile:
0μs
99th percentile:
0μs
Standard deviation:
0μs
Mean:
0μs
Minimum:
0μs
Maximum:
0μs
Converter time
95th percentile:
0μs
98th percentile:
0μs
99th percentile:
0μs
Standard deviation:
0μs
Mean:
0μs
Minimum:
0μs
Maximum:
0μs

So basically I am failing to understand why the tests on the configuration page say that it will extract my data, but then in the wild it is not appearing to do anything at all.

I’m not sure exactly what other information would be useful, but I’d be happy to provide anything I can.

[InfernoTK (Tim)]

So I thought I might give the GROK extractor a try instead, and I am running into the same scenario.

[shoothub]

Hello, check your extractors order in System/Inputs - Manage extractors, check button Sort extractors on right side on screen.

You probably try to extract from value request_uri_path which is parsed after new defined extractors.