Sorry, I forgot you need to deal with multiline values
| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json
| rex "Error log: (?<json>\{.*\})"
| spath input=json
@ITWhisperer Thanks for your reply but it is Not working for me.
What are you getting in the json field?
@ITWhisperer I have tried this and now it is working fine.
@ITWhisperer I think rex is not properly working.
Sorry, I forgot you need to deal with multiline values
| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json