split string from a field

[sahana]

Hi 

I have a message body text as like below

message : RequestBody : :  :{

                                 individualValue : {

                                                   xxxxxx;

                                                   YYYY;

-----------------------having many txt in between these

}

}

How can i fetch the string "individualValue" from the message body

[ITWhisperer]

Do you mean something like this?

| rex "(?<individualValue>individualValue\s:\s\{[^\}]+\})"

[sahana]

I need to assign this string to a field, something like service=individualValue after splitting

[ITWhisperer]

Do you mean like this:

| rex "(?<service>individualValue\s:\s\{[^\}]+\})"

The name of the field which rex puts the value into is in the angle brackets <>

Or do you want to split the individual values in the braces {} into a multi-value field?