I have a event like this
02.09.2022; seller david address 434 xyz house price 20000 [color:green] {noffloors: 5] status sold
02.09.2022; seller lenin address 222 abc house price 30000 [color:red] {noffloors: 7] status sold
Assuming address, price, color and noffloor are not indexed as fields. How do I obtain output like this ? I am thinking of using regex but i dnt know the exact experssion
address price color nofloor
434 zyz 20000 green 5
222 abc 30000 red 7
This rex statement will extract the data based on your example events
| rex "address (?<address>.*) house price (?<price>\d+)\s+\[color:(?<color>[^\]]*)\]\s+\{noffloors:\s(?<noffloors>\d+)"
but it's pretty rigid in that all fields must be in that format/order