Using rex to filter fields

[leandromatperei]

Hello everyone,

I have the following pattern of logs and I'm trying to use rex to filter the values, but I'm having problems because of + in some events, can you help me?

| rex field=_raw "DNIS:(?<ANI>\d+)"

2020-09-25 11:50:52.946-03:00 
DNIS:+558730246133

2020-09-25 11:51:33.218-03:00  
DNIS:994699160

2020-09-25 11:52:52.946-03:00 
DNIS:994376160

2020-09-25 11:53:52.946-03:00 
DNIS:+994699160

2020-09-25 11:54:52.946-03:00 
DNIS:+558730246133

[thambisetty]

| rex field=_raw "DNIS:\+(?<ANI>\d+)"

[richgalloway]

If you want to include the + in the field then try 

| rex "DNIS:(?<ANI>\+?\d+)"

If you don't want the + in the field then try this

| rex "DNIS:\+?(?<ANI>\d+)"