Need help with creating table and regex

[irshtnak]

{"line":{"log_type":"testlog","log_version":"1.0.0","service":"test","version":"1.0.0","timestamp":"2021-10-01T22:24:01.038Z","custom_data":{"info_to_log":"disneyworld {\"message\":\" Incorrect team id, cannot create relationship. \",\"status_code\":500}  \"{\\\"id\\\":\\\"fa351cd91130\\\",\\\"type\\\":\\\"test_add\\\",\\\"correlation_id\\\":\\\"e79ed142\\\",\\\"event_data\\\":{\\\"bar_id\\\":\\\"12312312\\\",\\\"mickeymouse_id\\\":\\\"12123212\\\",\\\"minniemouse_id\\\":\\\"121231\\\",\\\"disney_id\\\":\\\"1212312\\\",\\\"role\\\":\\\"cartoon\\\"}}\""},"level":"info","message":"disneyerror"},"source":"stdout","tag":"asawescw123"}

can anyone help with the query to create table where I can see the columns message (inside info_to_log), bar_id, mickeymouse_id, minniemouse_id  

[bowesmana]

@irshtnak 

if all the escaped quoting is as in the event, then see this example using your data

| makeresults
| eval _raw="{\"line\":{\"log_type\":\"testlog\",\"log_version\":\"1.0.0\",\"service\":\"test\",\"version\":\"1.0.0\",\"timestamp\":\"2021-10-01T22:24:01.038Z\",\"custom_data\":{\"info_to_log\":\"disneyworld {\\\"message\\\":\\\" Incorrect team id, cannot create relationship. \\\",\\\"status_code\\\":500}  \\\"{\\\\\\\"id\\\\\\\":\\\\\\\"fa351cd91130\\\\\\\",\\\\\\\"type\\\\\\\":\\\\\\\"test_add\\\\\\\",\\\\\\\"correlation_id\\\\\\\":\\\\\\\"e79ed142\\\\\\\",\\\\\\\"event_data\\\\\\\":{\\\\\\\"bar_id\\\\\\\":\\\\\\\"12312312\\\\\\\",\\\\\\\"mickeymouse_id\\\\\\\":\\\\\\\"12123212\\\\\\\",\\\\\\\"minniemouse_id\\\\\\\":\\\\\\\"121231\\\\\\\",\\\\\\\"disney_id\\\\\\\":\\\\\\\"1212312\\\\\\\",\\\\\\\"role\\\\\\\":\\\\\\\"cartoon\\\\\\\"}}\\\"\"},\"level\":\"info\",\"message\":\"disneyerror\"},\"source\":\"stdout\",\"tag\":\"asawescw123\"}"
| spath input=_raw line.custom_data
| rex field=line.custom_data "message..:..(?<message>[^\\\]*).*bar_id[^\d]*(?<bar_id>\d+).*mickeymouse_id[^\d]*(?<mickeymouse_id>\d+).*minniemouse_id[^\d]*(?<minniemouse_id>\d+)"
| table message bar_id mickeymouse_id minniemouse_id
| eval message=trim(message)

It uses spath to get the custom_data field then uses rex against that to extract the fields. It assumes the fields will be in the order wanted, if not, then you will have to adjust the rex.

Hope this helps