We have the following data ingested (not json format) , where we are trying to extract
"DeletedImages": 0 and "DeletedImages": 24 value pairs
Data:
2021-05-04 - 13:50:41.878 - INFO : Action completed in 0.192996025085 seconds, result is {
"images-deleted": 0,
"metrics": {
"Action": "Ec2DeleteImageAction",
"Data": {
"DeletedImages": 0
},
"Version": "1.0",
"Type": "action",
"ActionId": "12345"
},
"account": "123456789",
"task": "ABCD-EFGE-QAQ-DELETE-IMAGE",
"images": 535,
"region": "ab-east-1"
} - ReconNum:123456678901234
2021-05-04 - 13:55:41.878 - INFO : Action completed in 0.192996025085 seconds, result is {
"images-deleted": 0,
"metrics": {
"Action": "Ec2DeleteImageAction",
"Data": {
"DeletedImages": 24
},
"Version": "1.0",
"Type": "action",
"ActionId": "12345"
},
"account": "123456788",
"task": "ABCD-EFGE-QAQ-DELETE-IMAGE",
"images": 536,
"region": "ab-east-1"
} - ReconNum:123456678901235
Use rex with
| rex field=_raw "DeletedImages.:\s(?<DeletedImageCount>\d+)"
Use rex with
| rex field=_raw "DeletedImages.:\s(?<DeletedImageCount>\d+)"
Assuming that is two events. If it is a single event and you need to extract both values from it, then modify the rex statement like this
| rex field=_raw max_match=0 "DeletedImages.:\s(?<DeletedImageCount>\d+)"
and you will get a multi value field with the two values