Unable to create field using regex

[sagar_shubham]

Hi Team, 

Need your help in creating regex to create a field. 

"User_Claim":("sub":"qweihaytej"; "login_id":"[email protected]";........) 

Here User_Claim is a field. I have to create a field for login_id.

I have tried with this, and it's not working. 

..... | rex field=User_Claim " login_id"(? <loginID>\w+.) "

I am unable to see the field name in the interesting fields. 

Please suggest in this. 

Thanks

Sagar

[ashvinpandey]

@sagar_shubham Try using the below rex:

| rex field=_raw "login_id\"\:\"(?P<login_id>.*?)\""

Also if this reply helped you in solving your problem an up-vote would be appreciated 👍

[richgalloway]

That regex has a few extra characters in it (and some missing ones) that prevent a match.  Also, "\w+" won't match the full login_id field because of the "@" (which is not a word character).  Finally, embedded quotation marks need to be escaped.  Try this command:

| rex field=User_Claim "login_id\\\":\\\" \\\"(?<loginID>[^\\\"]+)"

[sagar_shubham]

This is not working Sir. 

[richgalloway]

Meaning what, exactly?  Please share the full query you tried, what results were expected, and what results you got.