Depending on whether your escaped quotes are in your data or not... This example includes the \ as part of the raw data string
| makeresults
| eval _raw="hello world \\\"employee\\\":123456"
| rex field=_raw "hello world \\\\\"employee\\\\\":(?<id>\d+)"
So, the 5 \ characters in rex will recognise the single \ in your data
