How to write regular expression for the below log and to extract Error code, ErrorMessage ?

[venkatanagendra]

Activity Result: {"IsProductValidated":"false","ErrorCodes":[{"errorCode":"PRD-202","errorMessage":"Product Validation Service Returned Error :: Reason: Options you have selected are not available at this time. Please change your selections."}]}

[pl2345]

You could use field extraction or the rex command.

| rex field="Activity Result" "Activity Result: {"IsProductValidated":"false","ErrorCodes":\[{"errorCode":"(?P<errorCode>\S+)","errorMessage":"(?P<errorMessage>.+)."}]}" 

[schose]

Hi @venkatanagendra ,

You do not need to do regex, as your data is already in  structured json format. Ensure your sourcetype is using kv_mode=json  or kv_mode=auto and you can address fields 

ErrorCodes{}.errorCode ErrorCodes{}.errorMessage

Best regards,

Andreas

[venkatanagendra]

Thanks for your quick response schose...but  if you see below image mentioned log comeing from (Alexinfomsg ) field, in this field Activity Result have Error code and Error message, these information we need to extract

[schose]

Hi @venkatanagendra ,

If the json you provided is part of an already existing field i would go with eval json functions

| makeresults
| eval json = "{\"IsProductValidated\":\"false\",\"ErrorCodes\":[{\"errorCode\":\"PRD-202\",\"errorMessage\":\"Product Validation Service Returned Error :: Reason: Options you have selected are not available at this time. Please change your selections.\"}]}"
| eval errorCode = json_extract(json,"ErrorCodes{}.errorCode"), errorMessage = json_extract(json,"ErrorCodes{}.errorMessage")
| table _time errorCode errorMessage

Best Regards,

Andreas