Hi, I'm having trouble with a regex field extraction. I'm looking to extract the numeric ID after the "x-client-id" key:
.........pp_code":["{IVR-US}. CPC"],"x-client-id":["1234567890"],"x-requested-with":["DA_ONLINE_IV............
This is how that field appears in the event string. This (client-id) is the only field I need in the entire string. The quotes are throwing off all of my normal regex formats.
Any help would be super appreciated.
@mkulicke Try using the below rex:
| rex field=_raw "x-client-id\"\:\[\"(?P<client_id>\d+)"
Also, If this reply helps you, an upvote would be appreciated.
@mkulicke Try using the below rex:
| rex field=_raw "x-client-id\"\:\[\"(?P<client_id>\d+)"
Also, If this reply helps you, an upvote would be appreciated.
Works like a charm, thanks for your help!