Need Regex to pull all the pid,PPID and MD5 values

[venkatasri]

@SabariRajanT  you can try this however they should have been auto extracted for you. Did you try to run in Verbose mode?

| rex field=_raw "\\\"pid\\\"\:(?<pid>\d+)" 
| rex field=_raw "\\\"ppid\\\"\:(?<ppid>\d+)" 
| rex field=_raw "\\\"md5\\\"\:\\\"(?<md5>\S+)\\\""

Alternatively you can use the | spath command as well.

---

An upvote would be appreciated if this reply helps! 

[PickleRick]

At first glance it looks that they should be auto-extracted but notice that most of the data in the example is not a json section but a string. So you'd need to separately parse it as json (or extract with a regex, as you showed. Also, it's worth noticing that the value you'll get from your regexes will need to be unescaped.