Help with Regex?

[MrIncredible]

 I have a field "facilityAlias" for which location can be changed in every api log file. I have to extract that field using Regex method. I have tried Regex statement but not getting expected result.

Regex statement: rex field=_raw "facilityAlias\":\"(?<facility>.*)\","

expected result: Parc de Salut Mar Barcelona
current result: Parc de Salut Mar Barcelona","systemName":"CMPSB

Sample Log file:

sample log: 2023-01-02 23:36:58,521 [[MuleRuntime].uber.3869: [abcd-message-kdhskhdsk-api].Delete_msg_from_queue.BLOCKING @27fe0275] INFO  com.skdhksh.jsdhjshd.hsd.logging.internal.CustomLoggerOperations - {"environment":"stag36rcf_eu-env","applicationName":"abcd-message-kdhskhdsk-api","correlationId":"kshddhks-3o4u-jshd8-aksdbkadkahd","apiProcessingTime":347,"totalProcessingTime":740,"tracePoint":"END","logMessage":"{\n  \"url\": \"abcd\",\n  \"bucketName\": \"dipeus-data-store\",\n  \"s3versionID\": \"shdkshdkshdkshdkshdkshdkjshd\",\n  \"s3key\": \"ljdljdlajldj]dsdsd\ksdjksjdksjdksjdksjksjd\ksdjksjd\"\n}","txnMetadata":{"bundleId":"ahsdkhsdh-skjdhshdkshd-skdhshdks-skdhkshd","messageType":"abcd","messageSubType":"kdshdkshdks","facilityAlias":"Parc de Salut Mar Barcelona","systemName":"CMPSB","transactionStartTime":1672702617781,"relatesToPatientMerge":false,"inputPayload":"adhkjshdkshdkshdkshd"},"apiStartTime":"1672702618174"}

[MrIncredible]

Many thanks @gcusello for your quick reply. 2nd option will work as in 1st option i don't want to restrict it with particular postfix.

[gcusello · Accepted solution]

Hi @MrIncredible,

you can use:

| rex "facilityAlias\":\"(?<facility>.*)\",\"systemName"

or (better):

| rex "facilityAlias\":\"(?<facility>[^\"]*)"

that's more generic and you can test at https://regex101.com/r/jnbSgk/1 .

Ciao.

Giuseppe