@irshtnak
if all the escaped quoting is as in the event, then see this example using your data
| makeresults
| eval _raw="{\"line\":{\"log_type\":\"testlog\",\"log_version\":\"1.0.0\",\"service\":\"test\",\"version\":\"1.0.0\",\"timestamp\":\"2021-10-01T22:24:01.038Z\",\"custom_data\":{\"info_to_log\":\"disneyworld {\\\"message\\\":\\\" Incorrect team id, cannot create relationship. \\\",\\\"status_code\\\":500} \\\"{\\\\\\\"id\\\\\\\":\\\\\\\"fa351cd91130\\\\\\\",\\\\\\\"type\\\\\\\":\\\\\\\"test_add\\\\\\\",\\\\\\\"correlation_id\\\\\\\":\\\\\\\"e79ed142\\\\\\\",\\\\\\\"event_data\\\\\\\":{\\\\\\\"bar_id\\\\\\\":\\\\\\\"12312312\\\\\\\",\\\\\\\"mickeymouse_id\\\\\\\":\\\\\\\"12123212\\\\\\\",\\\\\\\"minniemouse_id\\\\\\\":\\\\\\\"121231\\\\\\\",\\\\\\\"disney_id\\\\\\\":\\\\\\\"1212312\\\\\\\",\\\\\\\"role\\\\\\\":\\\\\\\"cartoon\\\\\\\"}}\\\"\"},\"level\":\"info\",\"message\":\"disneyerror\"},\"source\":\"stdout\",\"tag\":\"asawescw123\"}"
| spath input=_raw line.custom_data
| rex field=line.custom_data "message..:..(?<message>[^\\\]*).*bar_id[^\d]*(?<bar_id>\d+).*mickeymouse_id[^\d]*(?<mickeymouse_id>\d+).*minniemouse_id[^\d]*(?<minniemouse_id>\d+)"
| table message bar_id mickeymouse_id minniemouse_id
| eval message=trim(message)
It uses spath to get the custom_data field then uses rex against that to extract the fields. It assumes the fields will be in the order wanted, if not, then you will have to adjust the rex.
Hope this helps
