How to use a combination of multiple regex cindition in transforms.conf

[hyugma]

Hi Expert,
I am trying to confiture transforms that has multiple condition for match, with the following condition:

(word1 OR word2) AND word3 NOT ('phrase 4' OR 'phase 5')

and I tried the following config, but still no luck.

[source::.../input.log]
REGEX =^(?=.*(word1|word2))(?=.*word3)(?!.*(phrase 4|phrase 5)).*$
FORMAT = sourcetype::mytype
DEST_KEY = MetaData:Sourcetype

The regex may be wrong or there is another workaround to archive this... 
Any comment and/or recommendation would be really appreciated..

[richgalloway · Accepted solution]

IME, anchors aren't needed that often and it's a rare case that needs both ^ and $ anchors.

Have you used regex101.com to test your regular expression against samples of your data?

[hyugma]

Thank you for the comment. 

You are right, I would not need many anchors everywhere.
and I could confirm that the regex with AND and OR mixed worked.

Thank you, @richgalloway