How to use rex to extract JSON format to 2 keyValue pairs?

[ivanlin]

2016/11/14 17:27:35:449||DeviceID=12C95D85-AC78-499A-A018-E8ADB1CC6D0E||LogLevel=Info||AppVersion=v1.0.4.8(1.0)||OSType=iPhone OS||OSVersion=8.3||ConnectStatus=1||UploadTime=2016/11/14 17:27:35:449||RemoteClientIP=192.168.255.239||ClientID=(null)||Coordinate=25.054545,121.548664||Event=1||TransactionDetail={
  "Event" : "StartiEasy"
}

I want to extract 2 field first "msg" "value":

Event

"msg2" field "value":

StartiEasy

Please advise.. Thanks.

[richgalloway · Accepted solution]

Here's one way

... | rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}" | ...

[ivanlin]

Sorry, the result as below

source="ieasy.log" host="ivan-pc" sourcetype="ieasy" 
| rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}\"

Unbalanced quotes.

[richgalloway]

Sorry about that. I fixed my answer.

[ivanlin]

It's OK, Thanks a lot.