Extract multiple values with the same delimiter

[christopheducha]

Hi

I'm trying to regex my way into this puzzle, let me explain my problem.

event 1 (field 2) raw value = log:word1 log:word2 log:word3
event 2 (field 2) raw value = log:19 log:word4

or

The value in field2 from the first event (raw value).
log:word1 log:word2 log:word3
The value in field2 from the second event (raw value).
log:19 log:word4

I want to extract these "log:" values into 3 fields.
Something like field log1 , log2 and log3.

So I tried with this regex  ":(?<log1>\S*) log:(?<log2>\S*) log:(?<log3>\S*)"
Works perfectly with event 1, but didn't work for event 2 because there or only 2 “log:” values.

Can anybody tell me how to make this work?

[richgalloway · Accepted solution]

Make the third set optional.

:(?<log1>\S*) log:(?<log2>\S*)(?: log:(?<log3>\S*))?

[christopheducha]

Thank you much appreciated.