Need help with rex extraction including double quotes and slashes

[gamerkhang]

Hi,

I am currently trying to extract the numbers from this field example:

message.data

... {\"MyID\":\"111111\", ...

so I wrote the following rex expression, with no results:

rex field=message.data "\\\"MyID\\\":\\\"(?<MyID>\d+)\\\""

I have tried different amounts of slashes, and I am confident that the section inside the parentheses is correct for my needs.

[somesoni2 · Accepted solution]

Give this a try

....  | rex field=message.data "\"MyID([^\"]+\"){2}(?<MyID>\d+)"

[gamerkhang]

This worked for me. Thanks!

[MuS]

Please use the code function while selecting the regex to keep formatting; code can be applied by clicking the 101010 icon or pressing CTRL-k

cheers, MuS