Find logs of requests that are longer than 1000ms using regex

Question

I'm using regex to search Google Cloud Logs for requests that are longer than 1000ms

Here are some example requests:

{
    ...
    textPayload: "GET /getUser 200 - - 5380.879 ms",
    ...
}
{
    ...
    textPayload: "GET /getUser 200 - - 34.879 ms",
    ...
}

Here is the search I'm using:

textPayload =~ "^(GET)|(POST).*[1-9][0-9][0-9][0-9]|\d{4,}(\sms)$"

I only want to return the one that ends with a value of over 1000.000 ms but my regex doesn't seem to work. What am I doing wrong?

Answer 1

You need to use

textPayload =~ "^(?:GET|POST).* ([1-9]\d{3,}(?:\.\d+)?)\sms$"

See the regex demo.

Details:

• ^ - start of string
• (?:GET|POST) - GET or POST
• .* - any zero or more chars other than line break chars as many as possible and then a space
• ([1-9]\d{3,}(?:\.\d+)?) - Group 1: a non-zero digit, then three or more digits and then an optional sequence of a . and then one or more digits
• \s - a whitespace
• ms - ms string
• $ - end of string.