regex field extraction - match field in double quotes after sting match

[rotundwizard]

I'm attempting to build a regex that will extract a field enclosed in double-quotes, after a string match. Basically I want to extract a field 4 fields after the string POST. All fields enclosed in double-quotes, separated by commas.

"*several fields*","POST","field1","field2","field3","field4","**THE_FIELD_I_NEED**"

Any assistance would be welcome!

[woodcock]

Like this:

... | rex "\"POST\",(?:[^\,]+,){4}\"(?<the_field_I_need>[^\,]+)\""

[saurabhkharkar]

Try this

|rex field=_raw "POST\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"(?<optuput>\w+)\""

[chrisyounger]

Be aware this this one won't work correctly if one of you fields has spaces in it.

[chrisyounger · Accepted solution]

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

[rotundwizard]

This technically did work, for my specific situation it did not (my fault for not providing sufficient detail). One of the fields after the POST string contains a comma. Which would be fine, except that comma isn't always there depending on the log data. Would it be possible to key in on the double-quotes, instead of the commas?

"several fields","POST","field1" "field2","field3","field4","thefieldIwant"

OR

"several fields","POST","field1" "field2","field3","field,4","thefieldIwant"

[chrisyounger]

Try this one:

https://regex101.com/r/ObxLtM/2

\"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\,]+)\"

[chrisyounger]

or this \"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\"]+)\"

https://regex101.com/r/ObxLtM/3

[rotundwizard]

Both work perfectly, thank you very much!