hello everyone,
my event data looks like this
{\"status\":1,\"httpStatus\":200,\"event\":\"getBooks\"}
My goal is to extract httpStatus as a field so I can filter events by their codes(e.g 200, 400 ..)
I learned that we need to escape backslashes and double quotes but the command below didn't work
| rex "httpStatus\\\":(?<http_status>\d+)"
What did i do incorrectly here?
... View more