topic How to use a combination of multiple regex cindition in transforms.conf in Getting Data In

How to use a combination of multiple regex cindition in transforms.conf

hyugma — Tue, 10 Aug 2021 14:57:07 GMT

Hi Expert,
I am trying to confiture transforms that has multiple condition for match, with the following condition:

(word1 OR word2) AND word3 NOT ('phrase 4' OR 'phase 5')

and I tried the following config, but still no luck.

[source::.../input.log] REGEX =^(?=.*(word1|word2))(?=.*word3)(?!.*(phrase 4|phrase 5)).*$ FORMAT = sourcetype::mytype DEST_KEY = MetaData:Sourcetype

The regex may be wrong or there is another workaround to archive this...
Any comment and/or recommendation would be really appreciated..

richgalloway — Tue, 10 Aug 2021 15:25:12 GMT

IME, anchors aren't needed that often and it's a rare case that needs both ^ and $ anchors.

Have you used regex101.com to test your regular expression against samples of your data?

hyugma — Tue, 24 Aug 2021 07:13:56 GMT

Thank you for the comment.

You are right, I would not need many anchors everywhere.
and I could confirm that the regex with AND and OR mixed worked.