extract message field from JSON

[Esky73]

trying to extract the msg field from an azure blob which uses the _json sourcetype - the msg : field shows as one long field - how to extract this please ?

msg: 2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE::
Validate - user {"_id":"25fd57973c","email":"blah@hotmail.com","email_verified":true,"clientID":"8NReZXmds4","updated_at":"2018-07-10T06:53:42.764Z","name":"blah@hotmail.com","picture":"https://web.png","user_id":"email|5b3c37dd","nickname":"nickname","identities":[{"user_id":"5b3c3","provider":"email","connection":"email","isSocial":false}],"created_at":"2018-07-04T02:58:55.014Z","user_metadata":{"firstname":"bob","lastname":"bob","name":"bob bob"},"global_client_id":"rEJsAkwGVI","app_metadata":{"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_xxxxx"}}},"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_46"}},"persistent":{}}

thanks

*** UPDATE ***

So i've made some progress where i can create a new_msg field stripping off the non-json part of the msg field :

2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE::Validate - user

and then that allows me to run spath on the new_msg

| rex field=msg "^[^{]+(?<new_msg>.*)" | spath input=new_msg

now my field count has gone from ~50 to 500+

Is there a better way ?

[manish_singh_77]

Pls try this in your search and let me know..

extract pairdelim=",", kvdelim='":"'

[manish_singh_77]

You can also use the below mentioned regex, there are two regex, one captures everything after msg and other captures only till email, try this and let me know if it works for you.

yourBaseQuery
|rex "\msg:\s+(?.*)"
| complete your search

yourBaseQuery
| rex \msg:\s+(?\w+-\w+-\w+:\w+:\w+.\w+\s+\w+)
| complete your search

[Esky73]

both of these errored with Regex: unrecognized character follows \

I have updated my progress above. TY