I am struggling to fetch the data between curly brackets . Have tried multiple rex searches, however still not getting the required output :-
Message in log is as below:
msg=Call to https://hostname/rs/cf/webservice/user/authn failed. Status code: 401, response: {"statusCode":"Code","message":"Authentication failed"}|exception=|
I want to everything after response till exception.
Can anyone help with this please?
Like this:
... | rex "(?ms)response:\s*(?<MyNewField>\{[^\}]+\})"
Thanks Woodock. This was really quick response.
May I know the purpose of (?ms) ?
In case your raw event data is multi-line. You probably do not need it.