Why does regex keeps extracting wrong data?

[jhilton90]

I am trying to use the rex command to extract an id number, which is a mixture of letters and numbers separated by a dash. For example, one of the ids looks like this:

34gv564-3333-5tg4-gt53-4rgt5eg5g35gb

The field itself is as follows: MFA challenge succeeded for account aaaaaaaaa with email example@example.co.uk. Session id is 34gv564-3333-5tg4-gt53-4rgt5eg5g35gb

The rex command I'm using is as follows:

| rex "(?i) is (?<id_number>[^\"]+)"

The only problem is that sometimes it extracts the email address bit too

Any help would be greatly appreciated

[richgalloway]

To avoid extracting data from the wrong place, the regex should be more specific.

| rex "Session id is (?<id_number>[^\"]+)"

Since we only have a partial event to work with (the regex implies something in quotes follows, but it's not in the example event), it's impossible to know if there is a better way to extract the field.

[karu0711]

try this

| rex ^(?<id_number>.+)

[jhilton90]

That just extracts the entire event unfortunately

Thanks anyway though