As of now I am using:
rex field=URI mode=sed "s/=[^?]+/=xxx/g"
But its not working
/v1/mb/members/15d628b4-0d113-09b8ec770efd/option
/v1/mb/members/216570ce-c199-4ab9--c0cf3ddd404e/option
/v1/mb/members/36fbe9a8-882d-4a94-882561f81074/option
/v1/mb/members/4d573446-1d4f-483a-c5d64c33/option
/v1/mb/members/5cc2fa84-4b91-45bf-9c1/option
Your current rex is telling the system to replace an =, followed by any number of things that are not ?, with xxx.
If you explain what you want it to do, then we can help you.
can you please post sample log entries and what do u want to extract/replace from those log entries.
rex field=URI mode=sed "s/[^?]+/xxx/g"