How do I extract a field from the _raw data

[danielsan]

Hi guys,

Tried my best googling an answer but have not been able to find something that fits my requirement.

I have the following raw_data:

... \"number_of_goods\":10,\"number_of_locations\":5, ...

How do I create a field called number_of_goods and number_of_locations where the value is 10 and 5?

Many thanks in advance!

[richgalloway]

Try the rex command. The backslashes are needed to escape the backslashes and quotes in your data.

<your search> | rex "number_of_goods\\\\\":(?<numberOfGoods>\d+),\\\\\"number_of_locations\\\\\":(?<numberOfLocations>\d+)" | ...

[danielsan]

It works, you really saved my day. I have one follow-up question though. I'm trying to extract a similar field but it has a decimal value, e.g. 0.25 and with the rex example I got from you, I only get the first digit before the decimal and I can't figure out how to get the full value.

[richgalloway]

The regex for a floating point number is \d+\.\d+.

[richgalloway]

If your problem is resolved, please accept the answer to help future readers.

[FrankVl]

I guess you could also avoid having to mess with those backslashes and escaped quotes, by doing:

| rex "number_of_goods[^:]+:(?<numberOfGoods>\d+),[^\w]+number_of_locations[^:]+:(?<numberOfLocations>\d+)"

https://regex101.com/r/RgxoTh/1