0

There are some information like as following in my log:

" .....Response Elapsed: 00:00:00.0194215....

.....Response Elapsed: 00:00:05.0174875....

.....Response Elapsed: 00:00:11.5434871....

.....Response Elapsed: 00:00:01.342283.... "

I want to search a result for elapsed time > 5 seconds, in the above information , the result should be like

Response Elapsed: 00:00:11.5434871

Response Elapsed: 00:00:05.0174875

I tried "| Regex "/^Response Elapsed: 00:00:00.0[5-9]/"",but it doesn't work.

Community
  • 1
  • 1
AdvancingEnemy
  • 382
  • 3
  • 20

1 Answers1

0

It's probably easier to find a regular expression for the negative case than the positive one. Your example regex could be made to work for 5-9 seconds, but what about a minute and 5-9 seconds, etc? Try this:

... | regex _raw!="Response Elapsed: 00:00:0[0-4]\.\d+" | ...
RichG
  • 9,063
  • 2
  • 18
  • 29