regex help

[surekhasplunk]

{"device":"abcd","host":"1.2.3.4"}
{"device":"efgh [ = ILO = ]","host":"2.3.4.5"}
{"device":"qrst - [ab cd ef]","host":"4.5.6.7"}

My data looks like this in the _raw.

now i am trying to fetch device and host using regex. please help. It should be simple but since host is a default keyword the host from which data is coming is also coming with field name host so i need to rename host coming in _raw to ip

[to4kawa · Accepted solution]

|makeresults
| eval _raw="{\"device\":\"abcd\",\"host\":\"1.2.3.4\"}
{\"device\":\"efgh [ = ILO = ]\",\"host\":\"2.3.4.5\"}
{\"device\":\"qrst - [ab cd ef]\",\"host\":\"4.5.6.7\"}"
| multikv noheader=t
| fields _raw
| spath

[vnravikumar]

Hi

Try this rex

|rex "\"device\"\:\"(?P<device>[^"]+)\"\,\"host\"\:\"(?P<ip>[^"]+)"