Say I have an event in the form:
{
"a": {"b": "c"},
"d": "e"
}
I want to include the event if "c" matches a regex or if the value "e" is not null or empty.
How do I write a query for this? As far as I know, you can only find events matching a regex by using | regex <regular expression>
. Is there a way to do this like (d != "" AND d != null) OR ( a.b AND | regex <regular expression>)
?
I would recommend you use the rex command : |rex field=WHATEVER "(?<my_new_field>MATCH_TO_CHECK)"
This will simplify your conditional logic becuase you can just do:
eval includeRecord = if((d != "" AND d != null) OR ( a.b AND isnotnull(my_new_field)), "true", "false") | search includeRecord=true
Hope you can understand my untested code 🙂
I would recommend you use the rex command : |rex field=WHATEVER "(?<my_new_field>MATCH_TO_CHECK)"
This will simplify your conditional logic becuase you can just do:
eval includeRecord = if((d != "" AND d != null) OR ( a.b AND isnotnull(my_new_field)), "true", "false") | search includeRecord=true
Hope you can understand my untested code 🙂