2016/11/14 17:27:35:449||DeviceID=12C95D85-AC78-499A-A018-E8ADB1CC6D0E||LogLevel=Info||AppVersion=v1.0.4.8(1.0)||OSType=iPhone OS||OSVersion=8.3||ConnectStatus=1||UploadTime=2016/11/14 17:27:35:449||RemoteClientIP=192.168.255.239||ClientID=(null)||Coordinate=25.054545,121.548664||Event=1||TransactionDetail={
"Event" : "StartiEasy"
}
I want to extract 2 field first "msg" "value":
Event
"msg2" field "value":
StartiEasy
Please advise.. Thanks.
Here's one way
... | rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}" | ...
Here's one way
... | rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}" | ...
Sorry, the result as below
source="ieasy.log" host="ivan-pc" sourcetype="ieasy"
| rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}\"
Unbalanced quotes.
Sorry about that. I fixed my answer.
It's OK, Thanks a lot.