Have to capture "environment" : "uat" from this raw data to make a pie chart?

[aarun]

[02-23 13:55:00] INFO LoggerMessageProcessor [[MuleRuntime].uber.31: [emea-order-mgmt-sys-uat].postOrderMgmtSysFlow.CPU_INTENSIVE @3473fb44]: { "externalTrackingId": "567", "globalTransactionId": "cd535f86-38d4-4f1c-9d1f-e18bc745df21", "muleTransactionId": "c2d3f7f9-1743-4bde-931d-ac59987bb42e", "applicationName": "emea-order-mgmt-sys-uat", "httpMethod": "POST", "processName": "postOrderMgmtSysFlow", "environment": "uat", "src": "dummy_src", "target": "TargetSystemName", "milestoneStatus": "SuccessResponseReturned", "targetResponseTime": 0, "muleProcessingTime": 13}Collapsedate_hour = 13date_mday = 23date_minute = 55date_month = februarydate_second = 0date_wday = thursdaydate_year = 2023date_zone = localhost = http-inputs-olympus-eu.splunkcloud.comindex = mulesoft-emea-dev-demolinecount = 14punct = [-_::]____[[]..:_[----].._@]:_{__"":_"",__"":_"---source = http:mulesoftsourcetype = log4jsplunk_server = idx-i-01f4e4672afe12c83.olympus-eu.splunkcloud.comtimeendpos = 15timestartpos = 1

[bowesmana · Accepted solution]

Use

| rex "environment\"\s?:\s?\"(?<environment>[^\"]*)"

will give you an environment field

[aarun]

Thanks it worked. can you please help with another field from the same data "muleProcessingTime": 13

[bowesmana]

That's very similar, but it is not a quoted field, so 

| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"

However, it looks like you have JSON object nested inside that raw log message. Are any fields being automatically extracted? Maybe the JSON payload is already there as a field. If not you can do this

| rex ".*?(?<json>\{.*\})"
| spath input=json

which will take everything between the first and last {} and extract all the fields using spath from it. Then all the fields will be extracted to their own field names automatically.

[aarun]

@bowesmana  

| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"

This one i tried, not capturing the field. have to capture muleProcessingTime from that raw data. based on the captured 2 fields trying to make a chart

[bowesmana]

This example using your data extracts the muleProcessingTime from that data

| makeresults
| eval _raw="[02-23 13:55:00] INFO LoggerMessageProcessor [[MuleRuntime].uber.31: [emea-order-mgmt-sys-uat].postOrderMgmtSysFlow.CPU_INTENSIVE @3473fb44]: { \"externalTrackingId\": \"567\", \"globalTransactionId\": \"cd535f86-38d4-4f1c-9d1f-e18bc745df21\", \"muleTransactionId\": \"c2d3f7f9-1743-4bde-931d-ac59987bb42e\", \"applicationName\": \"emea-order-mgmt-sys-uat\", \"httpMethod\": \"POST\", \"processName\": \"postOrderMgmtSysFlow\", \"environment\": \"uat\", \"src\": \"dummy_src\", \"target\": \"TargetSystemName\", \"milestoneStatus\": \"SuccessResponseReturned\", \"targetResponseTime\": 0, \"muleProcessingTime\": 13}Collapsedate_hour = 13date_mday = 23date_minute = 55date_month = februarydate_second = 0date_wday = thursdaydate_year = 2023date_zone = localhost = http-inputs-olympus-eu.splunkcloud.comindex = mulesoft-emea-dev-demolinecount = 14punct = [-_::]____[[]..:_[----].._@]:_{__\"\":_\"\",__\"\":_\"---source = http:mulesoftsourcetype = log4jsplunk_server = idx-i-01f4e4672afe12c83.olympus-eu.splunkcloud.comtimeendpos = 15timestartpos = 1"
| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"

so if it is not capturing it in your example, then there is something different with your data. Can you provide an example, for example, so

your search
| head 1
| rex "muleProcessingTime\"\s?:\s?(?<muleProcessingTime>\d+)"
| table _raw muleProcessingTime

[aarun]

@bowesmana  It's capturing but showing an error in regex100 as Your regular expression does not match the subject string. 

[bowesmana]

The quotes around the rex expression are not part of the match, so should not be included in the regex101 expression