extract specific field

[ra_52194724]

i want to extract last word in resource_id field from below events.

[ITWhisperer · Accepted solution]

https://regex101.com/r/cBungW/1

"resource_id": "[^"]*?(?<last_word>\w+)"

| makeresults
| eval _raw="{\"resource_id\": \"/subscriptions/85bbb6fe-yyyy-xxx-81a6-806aaa0ca/resourceGroups/vg-test/providers/Microsoft.Web/sites/TestAPI\", \"metric_name\": \"FSUsage\", \"timeStamp\": \"2025-12-14T14:48:00Z\", \"subscription_id\": \"85bbb6fe-yyyy-xxx-81a6-806aaa0ca\", \"unit\": \"Bytes\", \"namespace\": \"microsoft.web/sites\", \"resource_group\": \"vg-test\", \"average\": 0}"
| append
    [| makeresults 
    | eval _raw="{\"resource_id\": \"/subscriptions/85bbb6fe-yyyy-xxx-81a6-806aaa0ca/resourceGroups/vg-test/providers/Microsoft.Sql/servers/test-sql-01/databases/Test_Prod\", \"metric_name\": \"allocated_storage\", \"timeStamp\": \"2025-12-14T14:57:00Z\", \"subscription_id\": \"85bbb6fe-yyyy-xxx-81a6-806aaa0ca\", \"unit\": \"Bytes\", \"namespace\": \"microsoft.sql/databases\", \"resource_group\": \"vg-test\", \"average\": 855016}"]
| rex "\"resource_id\": \"[^\"]*?(?<last_word>\w+)\""