I have this multivalue fields where i am tring to rex and get particular field value like
"value":"ESC1000", but instead getting multiple.
Tried with this but shows all the fields value
| rex max_match=0 "value\":\"(?<ESC>[^\"]+)"
"productChanges":[
{
"Products":[
{
"productSpecContainmentID":"1",
"changedCharacteristics":[
{
"characteristicID":"2",
"value":"SERVICE"
},
{
"characteristicID":"3",
"value":"99"
},
{
"characteristicID":"4",
"value":"monthly"
},
{
"characteristicID":"5",
"value":"ESC1000"
},
{
"characteristicID":"6",
"value":"Discount"
},
{
"characteristicID":"7",
"value":"Escalation"
},
{
"characteristicID":"8",
"value":"AMOUNT"
},
{
"characteristicID":"9",
"value":"9"
},
{
"characteristicID":"10",
"value":"Y"
},
{
"characteristicID":"11",
"value":"N"
}
],
"temporaryID":"xxxaaaacccc"
}
]
}
]
Is there a way to get the required fields value only like above?
Assuming your value always starts with ESC, give this a try:
| rex "value\":\"(?<ESC>ESC[^\"]+)"
Assuming your value always starts with ESC, give this a try:
| rex "value\":\"(?<ESC>ESC[^\"]+)"
Also i have this url which has
https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create
is there a way to regex and get these?
1015953 as customerId
58870 as productId
Try like this (UPDATED)
| rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"
uri=https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create?ac=n
I have the uri like this but the rex didnt show two new fields
I missed a colon in the regex. Added just now. Try the updated version.
thank you got the expected results