I am trying to extract key value pairs from JSON events using rex command
mysearch | rex field=_raw max_match=0 "\"(?<Key>\b\w+[^\":]*)\":(?!\s*{\[)\"*(?<Value>(?!\[{|{|\[)[^(,|}|\")]*)"
I have a single column CSV lookup with all the key names I am interested in
| inputlookup my_fields_json.csv | fields FieldName
Is there a way to use the lookup to make my rex command regular expression dynamic so I only extract the fields I am interested in?
