How to extract the field "alert" with the field name action?

[balu1211]

Hi,

how to extract the field "alert" with the field name action.

help with the regex..

Thanks.

[yuanliu]

@balu1211Have you tried my answer above? It creates key-value pairs, then extract them.

[balu1211]

@yuanliu

We have to create a new field name it's not the existing field.

Thanks..

[balu1211]

@ITWhisperer

@yuanliu

Could you please figure out the outputs of the above usecases.

Thanks

[ITWhisperer]

| rex "\"tag\":\"AKAMAI\/WAF\/(?<akamai_waf>[^\"]+)\""