Filed extracted like rex field = msg " student information\" : (?<studentname>.*?),"
Student name getting like below
"Stdent570"
"55555sdeend"
I want data with our double quotes
Hi @Sekhar,
if you could share some sample of your data I can be more sure.
anyway, you should try something like this:
| rex field=msg "student\s+information\"\s+:\s+\"(?<studentname>[^\"]*)"
Ciao.
Giuseppe
Sample data format
{\"studenrinformation\" : \"student577474\", }
Hi @Sekhar,
please trys this:
| rex field=msg "studentinformation\\\"\s+:\s+\\\"(?<studentname>[^\"]*)"
that you can test at https://regex101.com/r/GQVTYF/1
Ciao.
Giuseppe