Hello
I want to push values into a multivalue field.
The raw data are looking like the following:
Sep 6 14:27:56 This is a test from admin@chip.de to_address: test1@chip.de, test2@chip.de
Sep 7 12:24:34 This is a test from admin@chip.de to_address: test1@chip.de
Sep 7 12:24:34 This is a test from admin@chip.de to_address: test1@chip.de, test2@chip.de, test3@chip.de, info@web.com
Now I want to push all email addresses after the to_address into a multivalue field.
Does anyone know, how to achieve this?
Thanks
Hello,
in order to have a multivalue field from the regex, make sure to tweak the fields.conf as well:
TOKENIZER =
Use this setting to configure multivalue fields. A regular expression that indicates how the field can take on multiple values
at the same time. Otherwise, the first group is taken from each match to form the set of
values.
More info in the docs: fields.conf spec
Hope it helps, regards..
Try this
... | rex "to_address\:\s(?<to>.*)" | makemv to delim=", "