topic What is regex for below? in Security

What is regex for below?

karu0711 — Tue, 21 Mar 2023 16:21:59 GMT

FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147
I want to extract number after pie as field name "data". what is the regex?

Re: what is regex for below?

somesoni2 — Mon, 20 Mar 2023 20:54:33 GMT

Give this a try

\|(?<data>\d+)

Re: what is regex for below?

The_Data_Pirate — Mon, 20 Mar 2023 21:08:33 GMT

Hi Karu, this should work by taking the raw data and only selecting the digits after the pipe character. The space after the pipe is ignored before the digits are placed into a new field named data.

| rex field=_raw "\|\s(?<data>\d*)"

Re: what is regex for below?

manjunathmeti — Tue, 21 Mar 2023 03:06:11 GMT

You can check this and get to know how the data is extracted.
https://regex101.com/r/dECVmS/1

Re: what is regex for below?

karu0711 — Tue, 21 Mar 2023 14:18:03 GMT

FW: [ DOC 45 ] DTP: DEMO XXX CCC | 20147

I also need to separate [ DOC 45] as category
DTP as type

demo xxx ccc as call

Re: what is regex for below?

The_Data_Pirate — Tue, 21 Mar 2023 22:44:54 GMT

as long as the data structure doesn't change too much this should work.

| rex field=_raw ".*\[\s(?<category>.*)\s\]\s(?<type>\w*).*\|\s(?<data>\d*)"