Can you help me extract the following field values with a regex or any other alternative?

[arrangineni]

I have an event of the below format from a Firewall Source. I need to extract the field named "FieldChanges" from it. There are multiple fields separated by Pipe where I can use the Delimiter function, but I already have all other fields extracted except the above mentioned field.

Can you help me find a better way of extracting the field values with a Regex or any other alternative?

loc=8270|time=20Sep2018 13:10:57|action=accept|orig=application|i/f_dir=outbound|i/f_name=|has_accounting=0|product=SmartDashboard|ObjectName=Current_Policy_8|ObjectType=firewall_policy|ObjectTable=fw_policies|Operation=Modify Object|Uid={XYZ}|Administrator=xyz|Machine=ABC|FieldsChanges=Rule 132 UID = {sample data}  (sample data) Destination: added 'xyz';Rule 113 UID = {SAMPLE DATA}  (XYZ) Source: added 'N1XYZ_18_EDC_Network' ;|session_id=kflow Automatic Session|Subject=Object Manipulation|Operation Number=1|client_ip=ABC

Thanks in Advance.

[gcusello · Accepted solution]

Hi
if you want extract all that there's between "FieldChanges=" and the pipe "|", try this regex:

([^\|]+\|){15}FieldsChanges\=(?<FieldsChanges>[^\|]*)

You can test it at https://regex101.com/r/xrySrr/1

Bye.
Giuseppe