How to achieve "Message":"###1234$$$ Invalid" result with rex?

[wvsgo215]

splunk data: 2022-01-01T02:06:12.182Z 7c3edf29-c081-4cca-ae9b-0f79ef7d1c8d INFO {"InfoLogInformation":{"MethodName":"index.handler","Message":""Processing completed"","LogType":"Info","Error":"2022-01-01T02:06:12.040Z::400 - {"ResponseStatus":{"ErrorCode":"WorkBookMessageException","Message":"###1234$$$ Invalid." 

query: | rex ",\"Message\":\"\"(?<Message>.*?)\"\""
| rex "\"Exception\":\"400 - {\"ResponseStatus\":{\"ErrorCode\":\"(?<ErrorCode>.*?)\",\"Message\":\"(?<Message>.*?)\""

query result: Message = Processing completed  

I want the result should the Message":"###1234$$$ Invalid.

please help. TIA

[yuanliu]

@wvsgo215 Are you sure the illustrated data is complete and in original format?  I speculate that the original format could be something like

2022-01-01T02:06:12.182Z 7c3edf29-c081-4cca-ae9b-0f79ef7d1c8d INFO {"InfoLogInformation":{"MethodName":"index.handler","Message":"Processing completed","LogType":"Info"},"Error":"2022-01-01T02:06:12.040Z::400 - {'ResponseStatus':{'ErrorCode':'WorkBookMessageException','Message':'###1234$$$ Invalid.'}}"}

If the data is structured, use rex to extract the JSON object, then spath to extract from JSON.  If the log format is like the above, use

| rex " INFO (?<info_json>{.+)"
| spath input=info_json path=Error
| eval error_json = replace(Error, "^[^{]*", "")
| eval error_json = replace(error_json, "'", "\"") ``` JSON uses double quote ```
| spath input=error_json

You get

ResponseStatus.ErrorCode	ResponseStatus.Message	error_json	Error
WorkBookMessageException	###1234$$$ Invalid.	{"ResponseStatus":{"ErrorCode":"WorkBookMessageException","Message":"###1234$$$ Invalid."}}	2022-01-01T02:06:12.040Z::400 - {'ResponseStatus':{'ErrorCode':'WorkBookMessageException','Message':'###1234$$$ Invalid.'}}

SPL's builtin function is much more robust at handling structured data like JSON.

[gcusello]

Hi @wvsgo215,

please try this regex:

| rex "\"Message\":\"(?<message>[^\"]*?)\"\s"

that you can test at https://regex101.com/r/jdWRO8/1

Ciao.

Giuseppe