Hello everyone,
I have the following pattern of logs and I'm trying to use rex to filter the values.
I started doing it like this: | rex field=_raw "attr_itx_media_type\s(?<midias>.*)"
I need to get everything between ""
Ex. voicePerdida, smscustom, email
attr_itx_media_type [str] = "voicePerdida"
attr_itx_media_type [str] = "smsCustom"
attr_itx_media_type [str] = "email"
Hi @leandromatperei,
if yur logs are like the examples you shared the regex isn't correct, could you share a full sample of your logs?
Anyway, if you logs contains the string you shared, try the following regex:
| rex "attr_itx_media_type\s+\[str\]\s+\=\s+\"(?<attr_itx_media_type>[^\"]+)\""
that you can test at https://regex101.com/r/6TioIW/1
Ciao.
Giuseppe