Please help with regex to extract the first ip(highlighted red) only  2022-10-25T14:30:28.108+00:00 10.3.4.150 syslog-ng 14928 - [meta sequenceId="-2074435768"] Error processing log message: <14>1 2022-10-26T10:30:28.588005-04:00 RM-SU-SAM - - RemoteLogging>@< { "logVersion": "1.0", "category": "AUDIT", "timeStamp": "2022-10-26T14:29:43.439Z", "id": "K7pTSQoxfV7pvq3bO8PSehvilSt4yZxEiU9oGkasPx8=", "context": { "tenantId": "ZZNXA0OELD-STA", "originatingAddress": "104.205.81.157, 35.227.230.123, 130.211.2.118,172.30.9.68", "principalId": "opatel@mail.com", "sessionId": "c0r52fac-9fc3-42a1-8e48-492b31c72790", "globalAccessId": "10f31a5e-53b4-4bc8-9ec8-13bb6b670592", "applicationType": "SAML", "applicationName": "Splunk", "policyName": "Global Policy for STA" }, "details": { "type": "ACCESS_REQUEST", "state": "Accepted", "action": "auth", "credentials": [ { "type": "otp", "state": "Verified" } ] } ... View more

I'm trying to extract 1 fields from a log line. Just trying to extract the email. I cant extract a single field  and i get an error saying my rex has exceeded configured match_limit, consider raising the value in limits.conf. Any suggestion of where I am doing wrong? Is that possible is my rex(as below) not right? Used the splunk cloud field extractor   Error in 'rex' command: regex="(?ms)^\d+\-\d+\-\d+\w+\d+:\d+:\d+\.\d+\+\d+:\d+\s+\d+\.\d+\.\d+\.\d+\s+\w+\-\w+\s+\d+\s+\-\s+\[\w+\s+\w+="\d+"\]\s+\w+\s+\w+\s+\w+\s+\w+:\s+<\d+>\d+\s+\d+\-\d+\-\d+\w+\d+:\d+:\d+\.\d+\-\d+:\d+\s+\w+\-\w+\-\w+\s+\-\s+\-\s+\w+>@<\s+\{\s+"\w+":\s+"\d+\.\d+",\s+"\w+":\s+"\w+",\s+"\w+":\s+"\d+\-\d+\-\d+\w+\d+:\d+:\d+\.\d+\w+",\s+"\w+":\s+"\w+\d+\w+\d+\w+\d+\w+/\d+\w+\d+\w+\d+\w+\d+\w+/\d+\w+\d+\w+=",\s+"\w+":\s+\{\s+"\w+":\s+"\w+\d+\w+\-\w+",\s+"\w+":\s+"\d+\.\d+\.\d+\.\d+",\s+"\w+":\s+"(?P<sss>[^"]+)" has exceeded configured match_limit, consider raising the value in limits.conf   Sample logs 2018-10-14T12:55:30.418+00:00 10.3.4.150 syslog-ng 176 - [meta sequenceId="100000"] Error processing log message: <14>1 2018-10-21T08:55:30.791523-04:00 CB-ID-SCT - - RemoteLogging>@< { "logVersion": "1.0", "category": "AUDIT", "timeStamp": "2021-09-21T12:53:16.879Z", "id": "vy1m6dhu0xlrRdo0se5IJmWQnR8mPb+QpeFcILHySTU=", "context": { "tenantId": "ZZNXA0OELD-STA", "originatingAddress": "54.189.24.789", "principalId": "tundern@gmail.com", "sessionId": "cd419cd2-fge7f-5671-98c0-87d8b1e035dd", "globalAccessId": "42ga93ea-x5a9-81c8-4a87-b32b9abc3fa2", "applicationType": "SAML", "applicationName": "Cali Baco localSafetys - WC02", "policyName": "Global Policy for STA" }, "details": { "type": "ACCESS_REQUEST", "state": "Accepted", "action": "auth", "credentials": [{ "type": "cut", "state": "Verified" } ] } } ... View more