Hello all ,
Please help me to extract all values from this field :
arn:aws:iam::aws:policy/AmazonEC2FullAccess,AmazonEC2FullAccess
arn:aws:iam::aws:policy/CloudWatchActionsEC2Access,CloudWatchActionsEC2Access
arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess,AmazonSNSReadOnlyAccess
arn:aws:iam::aws:policy/CloudWatchLogsFullAccess,CloudWatchLogsFullAccess
arn:aws:iam::aws:policy/AmazonSSMFullAccess,AmazonSSMFullAccess
arn:aws:iam::aws:policy/CloudWatchEventsFullAccess,CloudWatchEventsFullAccess
I am not sure why are shown the policies twice, but I need the new column to be :
AmazonEC2FullAccess
CloudWatchActionsEC2Access
AmazonSNSReadOnlyAccess
CloudWatchLogsFullAccess
AmazonSSMFullAccess
CloudWatchEventsFullAccess
I used | rex max_match=0 field=attachedPolicies "(?(?<=,)[^\/]+$)"
, but it is not working it extract me the last value, and I need all the values of the field:
CloudWatchEventsFullAccess
Please help.
@braicu
You have not specified field name that will be extracted. Try: | rex max_match=0 field=attachedPolicies ".*\/(?<new_field>.*)"
.
Please check here: https://regex101.com/r/nyQXnb/1
Hope this helps!!!
@braicu
You have not specified field name that will be extracted. Try: | rex max_match=0 field=attachedPolicies ".*\/(?<new_field>.*)"
.
Please check here: https://regex101.com/r/nyQXnb/1
Hope this helps!!!
Thank you so much , it worked !