Using rex to filter fields

[leandromatperei]

Hello everyone,

I have the following pattern of logs and I'm trying to use rex to filter the values.

I started doing it like this:  | rex field=_raw "attr_itx_media_type\s(?<midias>.*)"

I need to get everything between ""

Ex. voicePerdida, smscustom, email

attr_itx_media_type [str] = "voicePerdida"
attr_itx_media_type [str] = "smsCustom"
attr_itx_media_type [str] = "email"

[gcusello]

Hi @leandromatperei,

if yur logs are like the examples you shared the regex isn't correct, could you share a full sample of your logs?

Anyway, if you logs contains the string you shared, try the following regex:

| rex "attr_itx_media_type\s+\[str\]\s+\=\s+\"(?<attr_itx_media_type>[^\"]+)\""

that you can test at https://regex101.com/r/6TioIW/1

Ciao.

Giuseppe