Extracting Field from 2 different events

[ralam]

Dear All,

I want to extract fields from the below events. The problem I'm facing is that the fields are not in harmony. For example, in event 1, "action" is the second last key however in event 2, it is the last one.

Similarly, some of the fields that are available in event 2, do not exist in event 1.

Can you guide me in extracting the fields from these events?

Event 1

Fri May 08 11:44:37 PDT 2020|{"timestamp":1588963477939,"caller":"xyz@abc","applicationId":null,"applicationName":null,"action":"LOGIN","message":"User [xyz@abc] logged in successfully"}

Event 2

Fri May 08 18:44:38 UTC 2020|{"timestamp":1588963478783,"caller":"xyz@abc","applicationId":20575244,"applicationName":"TIB_TST","entityType":"APPLICATION","entityId":20575244,"entityName":"TIB_TST","changes":[{"property":"name","value":"TIB_TST"}],"action":"OBJECT_CREATED"}

[richgalloway · Accepted solution]

The fields don't have to be in harmony. You can use multiple rex commands to get each one. For example,

<your search> | rex "action\":\"(?<action>[^\"]+)"

[ralam]

Thank you @richgalloway. I have always believed that the bigger question has always a smaller answer.
Your answer solved my bigger issue. However, one small problem, using your method I extracted many fields but facing a weird issue with "entityId":20575244. I used "entityId\":(?<entityId>\d+)" for it which worked in search but the same failed while applying in the Field Extractor application. It could not match to a single event.

[richgalloway]

The field extractor may not like the escaped quote.