Should be easy enough, but not working for me. I am trying to pull a hostname of a log. I am terrible at regex and trying to get better.
^
= starts with
.*
= any number of characters
_
= space?
transforms.conf
DEST_KEY = MetaData:Host
REGEX = ^(.*)_
FORMAT = host::$1
Here is format of the log:
localhost nmap 25 tcp allowed smtp
For some reason it's not extracting this hostname.
Answered below, but from one RegEx certifiable person to another: I found this to be a great learning tool. 🙂
Oh, I like that, I'll add it to the arsenal of regex101.com...
If it's always the first space-delimited item in the log, then try...
REGEX=^[^\s]*
(the rest is the same). That's from the start of the string ^
search characters that aren't [^...]
a space \s
, and grab zero or more of those *
I think you are missing a capturing group in there: REGEX=^([^\s]*)
should do it.
Oh, good catch, thanks!