Extracting a field in quotes with regex

[mkulicke]

Hi, I'm having trouble with a regex field extraction. I'm looking to extract the numeric ID after the "x-client-id" key:

.........pp_code":["{IVR-US}. CPC"],"x-client-id":["1234567890"],"x-requested-with":["DA_ONLINE_IV............

This is how that field appears in the event string. This (client-id) is the only field I need in the entire string. The quotes are throwing off all of my normal regex formats.

Any help would be super appreciated.

[ashvinpandey · Accepted solution]

@mkulicke Try using the below rex:

| rex field=_raw "x-client-id\"\:\[\"(?P<client_id>\d+)"

Also, If this reply helps you, an upvote would be appreciated.

[mkulicke]

Works like a charm, thanks for your help!