It seems like things are moving under your feet - the syntax of your log message has changed from your original example, which had the text StandardizedAddressService, now it's StandardizedAddress. ...
See more...
It seems like things are moving under your feet - the syntax of your log message has changed from your original example, which had the text StandardizedAddressService, now it's StandardizedAddress. Note that if you create a regex to extract the fields, and the message changes, it will break the extraction. It would be useful, when you say you have errors - to show what you tried and what the result was, otherwise it's almost impossible to come up with some solution. So, on these assumptions. a) you have a JSON object after FROM: {} b) another JSON object after RESULT: 1 | {} - is "1" a fixed value or variable? Note that your example does NOT show valid JSON for the result. It is missing a comma after the Longitude value before the F - not sure if that is a typo or in your data. 97.999,"Longitude":-97.999"F Assuming it is a typo then your search should be this Your base data search goes here...
``` This line extracts the from and result JSON objects from your msgTxt field ```
| rex field=msgTxt "FROM:\s*(?<from>.*) RESULT:[^{]*(?<result>.*)"
``` This extracts the JSON from each of those objects ```
| spath input=from
| spath input=result
``` and this makes the field names a bit more sensible ```
| rename AddressDetails{}.* as Result.*, WarningMessages{} as Result.WarningMessages
| table Latitude Longitude *.Latitude *.Longitude Result.WarningMessages If you reply to these, please post your code in code blocks, so that it's easy to read