How to create regex for AWS ARN to extract region?

[chvenu17]

Please help to create regx to extract region from below aws ARN(us-west-2)

arn:aws:secretsmanager:us-west-2:1111111111:secret:/rds-oracle/xxxx-xx17sd-xxxxxx-xxx67xxx7gd7133/TEST-01TEST

[chvenu17]

Thank you , its working 

[isoutamo · Accepted solution]

Hi

...
| rex "^(?:\w+:){3}(?<region>[^:]+)"

this should do the extraction. If the ARN is on field, then you should add “field=<field name>” in rex.

r. Ismo

[chvenu17]

Can you help to brekdown, in case i want to modify to pull different field

[isoutamo]

Here is a link https://regex101.com/r/GVLrA1/1 where you could read what those are meaning. There is also easy to chain it.