Created on 09-09-2019 09:53 AM - last edited on 09-09-2019 10:14 AM by ask_bill_brooks
I have an event {"a":"avc123.abc.com","b":"24 - ny","c" : "21321kodi"}i would like to use extracttext to filter/extract only the "b" however, it is picking up the first match. How can I specify to extract text from field "b" only not "a" neither "c"
Created 09-09-2019 09:07 PM
@ANMAR
Try with this regex
(?:"b"\s*:\s*)"(.*?)",
This will extract only 24 - ny value from the given event
View solution in original post
Created 09-10-2019 07:59 AM
Found the solution! Just needed to apply the regex
(?:"b":.\w+?)(\d+)
thanks to @Shu_ashu