Thanks Ryan. I stand corrected.
Below is one way to get the result you are looking for.
While displaying an Event with the contents in the format you expect, select "Create Event Rule" in the upper right. This will open an Event Rule Wizard that keeps the event contents available to use. If you had properly formatted JSON in the Additional Information, those key value pairs will be listed as available variables under the Event Input section. Below is the result using your example
The "detail" variable above is now available to be used in a regex. This can be done clicking on the variable and using the regex tool to highlight the data to extract. You can also create the regex on this screen as well.
When using this wizard I have found it neccessary to create "Null" variables to account for any globing that is needed.
The resulting regex can be viewed using the editing toggle "</>" in the upper right of this window. It will display the regex created from the highlighting.
Note - If you update the regex on this screen you will lose the ability to use the highlighting method.
The above results in a variable called instance_ID that can be used in your rule where needed. It will be displayed under the Expressions section with the result from the data used in the Event Rule creation
For testing I added the instance_ID to the description.
The resulting Alert when sending a new event that matches this rule displays the description field with the Instance ID in it.
