How to use rex to isolate fields with double quotes?

[Foss]

Hello I am trying to isolate 'msg' field with multiple quotes and when I use rex is either cannot grab what I need or it continues through the data and doesn't stop, thanks!

outcome="Success"msg="The "Account is trusted for delegation" property was modified from No to Yes"cs3="

I have tried | rex field=_raw "msg=\"(?<msg>[^\"]+)" with no success.

[yuanliu · Accepted solution]

If you cannot predict how many quotes will appear in this "field", there  is no general solution.  Your best bet is to bet on that "cs3=" will follow "msg" field.

| rex "msg=\"(?<msg>.+)\"\s*cs3="

If that is not the case, you can try matching exactly even (0, 2, 4, ...) quotes inside quotes, like

| rex "msg=\"(?<msg>([^\"]+\"){0,2,4}[^\"]+)\""

[Foss]

thank you for the feedback, that worked nicely!