Extracting text from event using search

[fabiozihlmann]

Hi I am trying to make a dashboard that searches events and extracts the correlationId from the event so I can display that information in a cleaner manner.  I just want to be able to extract the correlationId using my search and it comes in two main patterns. 

The first event pattern 

and the second pattern

My current search is 

My ultimate goal is to make a table with a Correlation ID column and other vital information columns

I have not edited the source code yet, so please feel free to leave any feedback or clarifying questions if needed

[richgalloway]

Please post text rather than screen shots so we can use it in test cases.

[ITWhisperer]

| rex "correlationId(='| )(?<correlationId>[0-9a-fA-F-]+)"

Single quote might need escaping with a back-slash i.e. (=\'| )