Hi
I'm trying to regex my way into this puzzle, let me explain my problem.
event 1 (field 2) raw value = log:word1 log:word2 log:word3
event 2 (field 2) raw value = log:19 log:word4
or
The value in field2 from the first event (raw value).
log:word1 log:word2 log:word3
The value in field2 from the second event (raw value).
log:19 log:word4
I want to extract these "log:" values into 3 fields.
Something like field log1 , log2 and log3.
So I tried with this regex ":(?<log1>\S*) log:(?<log2>\S*) log:(?<log3>\S*)"
Works perfectly with event 1, but didn't work for event 2 because there or only 2 “log:” values.
Can anybody tell me how to make this work?
Make the third set optional.
:(?<log1>\S*) log:(?<log2>\S*)(?: log:(?<log3>\S*))?
Make the third set optional.
:(?<log1>\S*) log:(?<log2>\S*)(?: log:(?<log3>\S*))?
Thank you much appreciated.