regex help required

[ra_52194724]

i want to extract "uicgrupp=120 is lost" in one field after string matching <description": "Process>

"description": "Process C5A13 uicgrupp=120 is lost"

{"TOOL_Status": "OPEN", "description": "Process C5A13 uicgrupp=120 is lost", "Product_Name": "Application" "ORIGIN_Name": "Openazure","TOOL_Key": "58aa716bb1543", "TOOL_ID": "Openadcgbc"}
{"TOOL_Status": "OPEN", "description": "Process ||0 CG00 uicgrupp=120 is lost", "Product_Name": "Application" "ORIGIN_Name": "Openazure","TOOL_Key": "58xx716bb1543", "TOOL_ID": "Openadcgbc"}

[PickleRick]

Can you please copy-paste your whole event into a preformatted paragraph or code block?

It's not obvious what your event looks like.

[inventsekar]

Hi @ra_52194724 
just used the above two rex and here are the outputs:
pls try this: 

| makeresults
| eval log="{\"TOOL_Status\": \"OPEN\", \"description\": \"Process C5A13 uicgrupp=120 is lost\", \"Product_Name\": \"Application\" \"ORIGIN_Name\": \"Openazure\",\"TOOL_Key\": \"58aa716bb1543\", \"TOOL_ID\": \"Openadcgbc\"}"
| rex field=log "description\": \"Process \S+ (?<uicgroup>[^\"]+)\""
| table log uicgroup

----------------------------------------------------------------------------------------------
If this post or any post addressed your question, could you pls:
Give it karma to show appreciation

PS - As of May 2026, my Karma Given is 2312 and my Karma Received is 497, lets revamp the Karma Culture!
Thanks and best regards, Sekar
--------------------------------------------------------------------------------------------

[richgalloway]

If the intent is to skip the word following "Process" then this should do it.

description\": \"Process \S+ (?<uicgroup>[^\S]+)

[ITWhisperer]

https://regex101.com/r/8BaFP2/1

description\": \"Process (?<uicgroup>[^\"]+)\"

[ra_52194724]

I want to capture only "uicgrupp=120 is lost" into uicgroup group as of now it's capturing "||0 CG00 uicgrupp=120 is lost: where "||0 CG00" information useless for me and should not be included in uicgroup group.

[richgalloway]

Try my revised regex.  It should extract the desired text, assuming there are no embedded spaces.

[ITWhisperer]

Try inserting a positive lookahead (assuming "uicgrupp" is the correct spelling and not "uicgroup")

https://regex101.com/r/8BaFP2/2

description\": \"Process .+?(?=uicgrupp)(?<uicgroup>[^\"]+)\"