Rex extract not working

[Span]

Hi, I have my messages like below

msg: abc.com - [2023-11-24T18:38:26.541235976Z] "GET /products/?brand=ggg&market=ca&cid=5664&locale=en_CA&pageSize=300&ignoreInventory=false&includeMarketingFlagsDetails=true&size=3%7C131%7C1%7C1914&trackingid=541820668241808 HTTP/1.1" 200 0 47936  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "10.119.25.242:59364" "10.119.80.158:61038" x_forwarded_for:"108.172.104.40, 184.30.149.136, 10.119.155.154, 10.119.145.54,108.172.104.40,10.119.112.127, 10.119.25.242" x_forwarded_proto:"https" vcap_request_id:"faa6d72c-4518-4847-47b2-0b340bb27173" response_time:0.455132 gorouter_time:0.000153 app_id:"1ae5e787-31d1-4b6a-aa7a-1ff7daed2542" app_index:"41" instance_id:"5698b714-359f-4906-742e-2bd7" x_cf_routererror:"-" x_b3_traceid:"042db9308779903a607119a204239679" x_b3_spanid:"b6e3d71259e4c787" x_b3_parentspanid:"607119a204239679" b3:"1188a5551d8c70081e69521568459a30-1e69521568459a30"

msg: abc.com - [2023-11-24T18:38:25.779609363Z] "GET /products/?brand=hhh&market=us&cid=1185233&locale=en_US&pageSize=300&ignoreInventory=false&includeMarketingFlagsDetails=true&department=136&trackingid=64354799847524800 HTTP/1.1" 200 0 349377 "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" "10.119.25.155:53702" "10.119.80.152:61026" x_forwarded_for:"174.203.39.239, 23.64.120.177, 10.119.155.137, 10.119.145.11,174.203.39.239,10.119.112.37, 10.119.25.155" x_forwarded_proto:"https" vcap_request_id:"d1628805-0307-4bf7-7d8d-b1fa3a829986" response_time:1.211096 gorouter_time:0.000257 app_id:"1ae5e787-31d1-4b6a-aa7a-1ff7daed2542" app_index:"180" instance_id:"8faf9328-b05d-4618-7d12-96e6" x_cf_routererror:"-" x_b3_traceid:"06880ee3e5ad85b36dd3f4e64337a842" x_b3_spanid:"acb1620e517eebec" x_b3_parentspanid:"6dd3f4e64337a842" b3:"06880ee3e5ad85b36dd3f4e64337a842-6dd3f4e64337a842"
msg: abc.com - [2023-11-24T18:38:26.916331792Z] "GET /products/?cid=1127944&department=75&market=us&locale=en_US&pageNumber=1&pageSize=60&trackingid=6936C9BF-D9DD-4D77-A14F-099C0400345D&brand=lll HTTP/1.1" 200 0 48615 "-" "browse" "10.119.25.172:51116" "10.119.80.139:61034" x_forwarded_for:"10.119.80.195, 10.119.25.172" x_forwarded_proto:"https" vcap_request_id:"a3125da7-a602-4e17-6656-909f380c12ed" response_time:0.068075 gorouter_time:0.000737 app_id:"1ae5e787-31d1-4b6a-aa7a-1ff7daed2542" app_index:"156" instance_id:"4f44c63e-44c6-4605-7466-fe5d" x_cf_routererror:"-" x_b3_traceid:"731b434ec32bb0eb6236fd4a8b8e1195" x_b3_spanid:"6236fd4a8b8e1195" x_b3_parentspanid:"-" b3:"731b434ec32bb0eb6236fd4a8b8e1195-6236fd4a8b8e1195"


Iam trying to extract values brand market and cid from above url
with below query 

index  = dd | rex field=_raw "brand=(?<brand>[^&]+)" | rex field=_raw "market=(?<market>[^&]+)" | rex field=_raw "cid=(?<cid>\d+)" | table brand, market, cid

but I get the whole url after brand= getting extracted, not just brand market and cid values.

Please help

[richgalloway · Accepted solution]

In one example, the brand field is terminated by a space rather than an ampersand so add \s to the regex.

index  = dd | rex field=_raw "brand=(?<brand>[^&\s]+)" | rex field=_raw "market=(?<market>[^&]+)" | rex field=_raw "cid=(?<cid>\d+)" | table brand, market, cid