How to extract value of a required field using regx?

[hrishi_deshpand]

msg:  INFO | 2021-10-14 10:38 PM |  Message consumed: {"InputAmountToCredit":"22.67","CurrencyCode":"AUD","Buid":"1401","OrderNumber":"877118406","ID":"58916"}

In above sample data, I want to extract "InputAmount" to credit.  Also I wan to extract "ID" and perform another search to get its status (as status is in another event and needs to be extracted by mapping ID) 

This is for logs and I have lots of events to perform search on to generate report.

Any help would be appreciated.

[kamlesh_vaghela]

@hrishi_deshpand 

Can you please try this?

YOUR_SEARCH
|rex field=_raw "\"InputAmountToCredit\":\"(?<InputAmountToCredit>[^\"]+).+\"ID\":\"(?<ID>[^\"]+)"

My Sample Search :

| makeresults 
| eval _raw="msg:  INFO | 2021-10-14 10:38 PM |  Message consumed: {\"InputAmountToCredit\":\"22.67\",\"CurrencyCode\":\"AUD\",\"Buid\":\"1401\",\"OrderNumber\":\"877118406\",\"ID\":\"58916\"}"
|rex field=_raw "\"InputAmountToCredit\":\"(?<InputAmountToCredit>[^\"]+).+\"ID\":\"(?<ID>[^\"]+)"

 Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.