Cannot convert a rex pattern variable to use in a chart

[gsbpp]

I have the following splunk event:

2020-Jul-30 18:19:02.891Z level=DEBUG thread=https-jsse-nio-2720-exec-9 pid=20 code_location=c.x.p.service.WebhookEventServiceImpl request_id=1fPwftTa2ylVm7CbcwnBirNhhjX trace_id=79d2157d38d3fd37 Processing message event[id=WH-29K757251Y0625428-0EP848134S044830M; resourceType=dispute; paypalDebugId=bac532dd23d05] using routingKey[com.xoom.paypal-events.v1.CUSTOMER.DISPUTE.UPDATED].

1. I want to create a chart that aggregates by resourceType and routingKey.

2. I have the following command

index="myindex" sourcetype="mySourceType" "Processing message event" | rex field=instance "routingKey\[(?<eventType>)\]\s" | chart count by resourceType eventType

3. The result I get is just by resourceType. I am not  able to assign the <eventType> variable to a field name for the chart.splunk chart

[richgalloway]

The rex command is trying match against the instance field, but that field doesn't exist in the sample event. Try using 

| rex field=_raw ...

[isoutamo]

Hi

your regex for eventType needs fixing. Please try this

\[(?<eventType>[^\]]+)

r. Ismo