Trim JSON 中的字符串的正则表达式

Question

我在 LogZ 中有以下日志消息，我想在将其作为警报转发之前 trim：

[ {
 "message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:08Z\"}\n"
}, {
 "message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:06Z\"}\n"
}, {
 "message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:05Z\"}\n"
} ]

由于 LogZ (Kibana) 支持正则表达式，主要思想是删除 reason 字段及其携带的消息以外的所有内容。那么无论如何我可以使用正则表达式以以下消息结束吗？:

reason: Error while unmarshalling the incoming data. Likely due to formats mismatch

Answer 1

当然可以使用字符串 reason\":\" 中的 positive look behind 并提取其后面的所有字符，直到 \.

这里是例子：https://regex101.com/r/14otax/1

(?<=reason\":\")[^\]+

Trim JSON 中的字符串的正则表达式

Regex to Trim a String inside JSON

regex

kibana