Rex command

[prasant]

Need help to extract value between 2 fields eg: below

"status":"Active",
"birthDate":"xxxx-03-06",

I am trying below

rex field=details "\"status\"\:\"(?<contactStatus>[^\n\r\",]+)*\"birthDate\""

NOTE: there is another status field, so I am trying to use this option, as I know "birthDate " follows "status" field.

Thanks for you help in advance

[prasant]

Thanks,,, I used below "\"status\":\"(?<contactStatus>[^\n\r\"]*)\",\"birthDate\"", it also worked.

[bowesmana]

User (?s) for matching newline by . character. Try this

| makeresults
| eval details="\"status\":\"Active\",
\"birthDate\":\"xxxx-03-06\",
\"status\":\"otherstatus\""
| rex field=details "(?s)\"status\"\:\"(?<contactStatus>[^\"]*).+\"birthDate\""