@SabariRajanT you can try this however they should have been auto extracted for you. Did you try to run in Verbose mode?
| rex field=_raw "\\\"pid\\\"\:(?<pid>\d+)"
| rex field=_raw "\\\"ppid\\\"\:(?<ppid>\d+)"
| rex field=_raw "\\\"md5\\\"\:\\\"(?<md5>\S+)\\\""
Alternatively you can use the | spath command as well.
---
An upvote would be appreciated if this reply helps!
At first glance it looks that they should be auto-extracted but notice that most of the data in the example is not a json section but a string. So you'd need to separately parse it as json (or extract with a regex, as you showed. Also, it's worth noticing that the value you'll get from your regexes will need to be unescaped.