field extract help

[valpravin]

payload : {"nodeId":34567,"cycleCode":10}
someone please help me in how to extract nodeID

i tried like this :

rex field=_raw "\"nodeId\"\s:\s(?P)"

[vnravikumar]

Hi

Try this

| makeresults 
| eval temp="payload : {\"nodeId\":34567,\"cycleCode\":10}" 
| rex field=temp "payload\s:\s\{\"nodeId\"\:(?P<nodeId>[^,]+)"

or

| makeresults 
| eval temp="payload : {\"nodeId\":34567,\"cycleCode\":10}" 
| rex field=temp "payload\s:\s\{\"nodeId\"\:(?P<nodeId>\d+)"