Hello all,
Can someone help me build a regex that may allow me to extract 3 different fields from events where all the fields are concatenated?
Example of the event(everything in one line):
Comment_type1|Code100|description of Code100|Comment_type1|Code101|description of Code101|Comment_type1|Code102|description of Code103|Comment_type2|Code201|description of Code201|Comment_type2|Code8000|description of Code8000|Comment_type2|Code8001|description of Code8001|Comment_type3|Code7001|description of Code7001|Comment_type3|Code9001|description of Code9001|
What I would like to get:
fieldA|fieldB|fieldC
Comment_type1|Code100|description of Code100|
Comment_type1|Code101|description of Code101|
Comment_type1|Code102|description of Code103|
Comment_type2|Code201|description of Code201|
Comment_type2|Code8000|description of Code8000|
Comment_type2|Code8001|description of Code8001|
Comment_type3|Code7001|description of Code7001|
Comment_type3|Code9001|description of Code9001|
fieldA is always Comment_type1 OR Comment_type2 OR Comment_type3
fieldB its always a number with 3 or 4 digits
fieldC is a text string
Can someone help me with this?
Hi @nuaraujo,
Please try below regex
<yourBaseSearch> | rex field=_raw max_match=0 "(?<fieldA>Comment_type1|Comment_type2|Comment_type3)\|(?<fieldB>\w+\d{3,4})\|(?<fieldC>[^\|]*)\|?"
Hi @nuaraujo,
Please try below regex
<yourBaseSearch> | rex field=_raw max_match=0 "(?<fieldA>Comment_type1|Comment_type2|Comment_type3)\|(?<fieldB>\w+\d{3,4})\|(?<fieldC>[^\|]*)\|?"
Thanks @harsmarvania57 . You are awesome.