how to extract only one filed from events out of possible duplicates

[VI371887]

Hi I have event logs where

rex under field extraction, to extract each value following a string and stopping at first coma, and avoid duplicates

example :
hcyycuvubuv : 45544.466, "disk_byte" :23.45667, "disk_byte_quota": 23.345t,

in above string, I am only looking for numbers that come after "disk_byte" :
, which is 23.45667

problem is, in my events the disk_bytes string is not at the same location in logs and there's disk_bytes_quota which should be ignored.

example :

first event
chhchvhvh: 223. 455, "disk_byte" :23.45667,"disk_byte_quota": 23.345t,
gghffvhh:3455

second event
chhchvhvh: 223. 455, tuvjvujjvg:3456.566, "cpu_percentage":23.45677,gghffvhh:3455.788,"disk_byte" :23.45667, "disk_byte_quota": 23.345t,

[richgalloway · Accepted solution]

The regex string "disk_byte"\s:(?[\d.]+)" will extract the "disk_byte" field and ignore the "disk_bytes_quota" field.

[VI371887]

hi i am having similar issues,

with msg field

it's has different values can be numbers, strings, path, punctuations, blank space like shown below.

"msg" :"35556"
"msg" :"<<÷] {<} ;;"
"msg" :"ycuvuuu jvbigg buivuv"
"msg" :" "

now problem is, i have written rex as
\msg\":(? \". *\") \,

but it returns value which following msg field.

"msg" :"vjvuv igivc uvviv", "origin" :"abcgc", "time" :23.45677",