Rex not stopping capture after match

[ea-2023]

I'm not sure why rex is properly matching the beginning of the value I am looking for (NameofTeam), but it also matches and includes everything after it. As I understand it, my search should stop matching when it reaches "}, after matching the team name. What am I doing wrong?

index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>.+)\"},"

Sample Data:

{"Key": "OtherKey", "ValueString": "OtherValue"}, {"Key": "Owner", "ValueString": "NameofTeam"}, {"Key": "OtherKey", "ValueString": "OtherValue"},

Expected Output:

NameofTeam

Actual Output:

NameofTeam"}, {"Key": "OtherKey", "ValueString": "OtherValue"},

[kiran_panchavat]

You can try this regex also : 

"Key":\s*"Owner",\s*"ValueString":\s*"(?<Team_Name>[^"]*)"

Regex

[richgalloway · Accepted solution]

The + quantifier is greedy, meaning it will match as many characters as possible.  So you'll get everything from NameofTeam until the end of the data.  To avoid that, use the non-greedy quantifier +?, even better, change the pattern to match until the next quotation mark.

index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>.+?)\"},"

index=test | rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Team>[^"]+)\"},"

[ea-2023]

The first one did end up working for me. The second one for whatever reason was throwing Error in 'SearchParser': Mismatched ']'. Not a big deal for me since the first one works, but figured I'd mention it.

| rex field=_raw "Key\": \"Owner\", \"ValueString\": \"(?<Owner>[^"])\"},"

The second one is what I thought I was doing... capturing everything until it saw "},   🙂

Thank you for helping me with this!

[richgalloway]

The second rex command probably needs additional escaping, but since the first works for you we'll leave it at that.