want to extract field values from log and perform stats on it.

[nhatode]

Hi,

Below is my Log:

"{"log":"{'URI': '/api/**/***/search?', 'METHOD': 'POST', 'FINISH_TIME': '2021-Dec-15 12:15:04 CST', 'PROTOCOL': 'http', 'RESPONSE_CODE': 202, 'RESPONSE_STATUS': '202 ACCEPTED', 'RESPONSE_TIME': 4.114464243873954} ","service_name":"Digdug/digdug","container":"Digdug-digdug-2","environment":"PROD"}"

Want to extract "RESPONSE_CODE" value 

And show like below
  

RESPONSE_CODE	Count
202	1
200	6

Thanks

[richgalloway]

Here's one way.

<your search for Log>
| rex "RESPONSE_CODE':\s*(?<RESPONSE_CODE>\d+)"
| stats count by RESPONSE_CODE

[johnhuang · Accepted solution]

| rex "RESPONSE_CODE\'\:\s(?<RESPONSE_CODE>\d+)"
| stats count as Count by RESPONSE_CODE

edit: looks like @richgalloway beat me to it.