Do you mean to obtain something like this? field name field value Action Name Read Input Files GDrive Start Record Id Type Invoice Run Reference xx-0645-11ef-xx-xx Task Name C...
See more...
Do you mean to obtain something like this? field name field value Action Name Read Input Files GDrive Start Record Id Type Invoice Run Reference xx-0645-11ef-xx-xx Task Name Cash Apps PAPI applicationName ct-fin-abc-apps-papi-v1-uw2-ut applicationType PAPI applicationVersion 1.0.7 batchSize 0 businessRecordId businessRecordType detailText Start Reading Input Files from G drive domain CR C4E endpointSystem environment ct-app-UAT region us-ne-2 remainingRetries 0 stage MILESTONE status SUCCESS threadName [MuleRuntime].uber.05: [ct-fin-aps-apps-papi-v1-uw2-ut].abc-apps-schedular-main-flow.BLOCKING @68f82333 timestamp 2024-04-29 16:30:08.455 totalRecords 0 tx.fileName implementation.xml tx.flow read-input-files-sub-flow txlineNumber 71 worker 0 x-transaction-id xxxx-e691-xx-91bf-xxx As @gcusello suggested, you should use built-in JSON capability to do the job, not regex. Use rex only to extract the JSON part. Like this | rex "eilog.EILog:\s*(?<eilog>{.+})"
| spath input=eilog
| spath input=jsonRecord This is an emulation of your sample data. Play with it and compare with real data. | makeresults
| eval _raw = "INFO 2024-04-29 16:30:08,456 [[MuleRuntime].uber.05: [ct-fin-abc-apps-papi-v1-uw2-ut].abc-apps-schedular-main-flow.BLOCKING @68f82333] com.sfdc.it.ei.mule4.eilog.EILog: {\"worker\":\"0\",\"region\":\"us-ne-2\",\"applicationName\":\"ct-fin-abc-apps-papi-v1-uw2-ut\",\"applicationVersion\":\"1.0.7\",\"applicationType\":\"PAPI\",\"environment\":\"ct-app-UAT\",\"domain\":\"CR C4E\",\"x-transaction-id\":\"xxxx-e691-xx-91bf-xxx\",\"tx.flow\":\"read-input-files-sub-flow\",\"tx.fileName\":\"implementation.xml\",\"txlineNumber\":\"71\",\"stage\":\"MILESTONE\",\"status\":\"SUCCESS\",\"endpointSystem\":\"\",\"jsonRecord\":\"{\\n \\\"Task Name\\\": \\\"Cash Apps PAPI\\\",\\n \\\"Action Name\\\": \\\"Read Input Files GDrive Start\\\",\\n \\\"Run Reference\\\": \\\"xx-0645-11ef-xx-xx\\\",\\n \\\"Record Id Type\\\": \\\"Invoice\\\"\\n}\",\"detailText\":\"Start Reading Input Files from G drive\",\"businessRecordId\":\"\",\"businessRecordType\":\"\",\"batchSize\":\"0\",\"totalRecords\":\"0\",\"remainingRetries\":\"0\",\"timestamp\":\"2024-04-29 16:30:08.455\",\"threadName\":\"[MuleRuntime].uber.05: [ct-fin-aps-apps-papi-v1-uw2-ut].abc-apps-schedular-main-flow.BLOCKING @68f82333\"}"
``` data emulation above ```