field extract help

valpravin — Fri, 20 Mar 2020 01:13:09 GMT

payload : {"nodeId":34567,"cycleCode":10}
someone please help me in how to extract nodeID

i tried like this :

rex field=_raw "\"nodeId\"\s:\s(?P)"

Re: field extract help

vnravikumar — Fri, 20 Mar 2020 02:22:59 GMT

Try this

| makeresults 
| eval temp="payload : {\"nodeId\":34567,\"cycleCode\":10}" 
| rex field=temp "payload\s:\s\{\"nodeId\"\:(?P<nodeId>[^,]+)"

| makeresults 
| eval temp="payload : {\"nodeId\":34567,\"cycleCode\":10}" 
| rex field=temp "payload\s:\s\{\"nodeId\"\:(?P<nodeId>\d+)"