Help with ending search for rex expression

[pushpender07]

Hi All - I am using the below query

index=ABC "XYZ"| rex field=_raw "\"code\":\"(?.*)\"" | stats count by errorcode

This gives me an output like this
SR123","message":"Added Successfully." 2
SR456","message":"Declined." 4

the error code I am trying to extract is SR123 or SR456. How do I ensure the rex command ends errorcode at the 2nd " and only gives count for SR123 and SR456. Please help as I have never used rex field in command. Tried few hit and trial scenarios, didn't work.

[somesoni2 · Accepted solution]

Give this a try (regex is starting to capture value after code":" till next double quote)

index=ABC "XYZ"| rex field=_raw "\"code\":\"(?<errorcode>[^\"]+)" | stats count by errorcode

[pushpender07]

Follow up question. If the output of the original query is like below

SR123","message":"Added Successfully.","error":null.

and I would want the output till
SR123","message":"Added Successfully."

Can I do that using rex? This is to help folks know what each message means.

[thambisetty]

message will extract after code":" to till last comma in a row.

index=ABC "XYZ"| rex field=_raw "\"code\":\"(?<message>.+)," 

[pushpender07]

perfect, it worked. Can you please explain what did you change do logically?

[macadminrohit]

also you can use regex101.com , it helps a lot to build the regex.