For log management, I want to build Kibana reports based on log lines like this:
2018-01-31 11:50:00.212 Loading the user images took 234 ms
2018-01-31 10:23:01.984 Loading the user images took 331 ms
2018-01-31 10:12:41.323 Loading the user images took 512 ms
So, the report would take lines with the string Loading the user images took
Then the regex would extract the number as in /took (\d+) ms/
and build a chart or notification.
How do I do this?
(Searching for this topic, I find discussion of regex queries and indexes but nothing about this functionality (which is quite basic in Splunk.)