Extract fields using regex

[asakth22]

Hello!

I have a log message and trying to extract the “trace_id” using regex but unable to.

{“log”:“2024-10-29T14:24:40.877Z\u0009INFO\u0009frontend/best_eta.go:103\u0009Dispatch successful\u0009{"service": "frontend", "trace_id": "4c49bb2657a30ce58265e6ed014f150d", "span_id": "8c9a87f20fcd5434", "driver": "T727878C", "eta": "2m0s"}\n”,“stream”:“stderr”,“time”:“2024-10-29T14:24:40.877565888Z”}

matcherRegex: "trace_id":"(\w+)"

Can I get some help ??

[tonyswumac]

You can simply use the json filter if your logs are in json format (which looks like it is).

[asakth22]

@asakth22

“trace_id”:“(\w+)”

I’m trying to extract it from the loki derived field. So how can I use a json filter ?
Attached the snippet for reference.

[asakth22]

I’m trying to extract it from the loki derived field. So how can I use a json filter ?

[asakth22]

Got it working!!

Had to escape the backslash in regex.
\“trace_id\”:\s\“(\w+)\”