topic Re: Invalid regex when using `|` in All Apps and Add-ons

Invalid regex when using `|`

boris — Mon, 09 Apr 2012 23:41:14 GMT

I need to capture both "D" OR "=" using (D|=).

Editing the regex of the field extractor this works:

=(?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

But why does this not work?

(D|=)(?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

Its returns:

Invalid regex: no named extraction at position 0 (i.e., "(D|=)(?P<F..."). Expected "(?P<variable>pattern)"

Re: Invalid regex when using `|`

dwaddle — Tue, 10 Apr 2012 00:31:15 GMT

Sounds like a quirk in the field extractor, assuming that every capturing group has to have a named variable to go with it. A suitable workaround might be:

[|=](?P<FIELDNAME>[a-zA-Z0-9_.]+)[_.]geom

Re: Invalid regex when using `|`

boris — Tue, 10 Apr 2012 01:56:48 GMT

Not sure why but the same regex using "(x|y)" that did not work in the Field Extractor works OK when directly done in Search:

index=main sourcetype="mapfluence" | head 10000 | rex "(%3D|=)(?P<FIELDNAME>[^=^(%3D)]+)[_.]geom" | top 50 FIELDNAME

Re: Invalid regex when using `|`

dwaddle — Tue, 10 Apr 2012 02:01:35 GMT

I think it's a bug in the field extractor. It is making an assumption that every regex capturing group has a field name. The rex search command makes no such assumption.