how to extract fields from json format event?

[nehamvinchankar]

Hi all, i want to extract fields from event which is in json format

INFO [processor: anchsdgeiskgcbc/5; event: 1-57d28402-9058-11ee-83b7-021a6f9d1f1c] : DETAILS: [
{
"ERROR_MESSAGE": "\nError: abchdvshsuaajs.\n",
"NUMBER": "123r57",
"DB_TIMESTAMP": "2023-11-30"
},
{
"ERROR_MESSAGE": "\nError: ehwegagsuabajehss.\n",
"NUMBER": "63638w82u",
"DB_TIMESTAMP": "2023-11-30"
},

and similarly we have these error data in one event

Fields to be extracted -
ERROR_MESSAGE
NUMBER
DB_TIMESTAMP

[ITWhisperer]

Given that this doesn't appear to be wholly correct JSON, you could start with something like this

| rex "DETAILS: (?<details>\[.*\])"
| spath input=details 

[nehamvinchankar]

no this is not working

[ITWhisperer]

What results do you get then?

[nehamvinchankar]

details field is blank

[ITWhisperer]

Try this

| rex "(?ms)DETAILS: (?<details>\[.*\])"
| spath input=details