field extraction

[sahana]

Hi,

I need to extract a value  from a message field, which has multiple data values. as like below,

message:{user: xxxx,age:yy,gender:xxxx, position:"nnnn", place:yyy}

In the above i need to extract the position value, which may have n number datas present after this. So, I need to extract the position value by its name alone. 

And also this position value can be there with a name as designation also

[ITWhisperer]

From your example, the following rex should work

| rex "position:\"(?<position>[^\"]*)\""

Similarly for designation

Having said that, your example looks like it might be JSON but it not correctly formatted as JSON, so depending on what your actual data looks like, you may need to adjust the rex string