Hi,
I am currently trying to extract the numbers from this field example:
message.data
... {\"MyID\":\"111111\", ...
so I wrote the following rex expression, with no results:
rex field=message.data "\\\"MyID\\\":\\\"(?<MyID>\d+)\\\""
I have tried different amounts of slashes, and I am confident that the section inside the parentheses is correct for my needs.
Give this a try
.... | rex field=message.data "\"MyID([^\"]+\"){2}(?<MyID>\d+)"
Give this a try
.... | rex field=message.data "\"MyID([^\"]+\"){2}(?<MyID>\d+)"
This worked for me. Thanks!
Please use the code function while selecting the regex to keep formatting; code can be applied by clicking the 101010
icon or pressing CTRL-k
cheers, MuS