Why is regex not working?

[man03359]

Hi all!

I have a field called "correlation id" in my search output, out of which I am trying to extract another field called "key". e.g.

Correlation id field value: Stores_XstorePOSError_tjm1554_2023320

Then its corresponding key value: Stores_XstorePOSError_tjm1554, which I am able to achieve using this regex -

| rex field=correlation_id "^(?P<key>(?P<geo>(\w+[\._])?Stores)[\._](?P<incident_group>[^\._]+)([\._][^\._]+)?[\._](?P<device>[a-zA-Z]{3,4}[a-zA-Z\d]*))([\._])?" 

which is unfortunately not working for some correlation ids.

e.g. -

Correlation id field value: STP_Stores_DiskSpace_stp-44slcapp9_20230809

Key value coming is: STP_Stores_DiskSpace_stp

I assume it is because in the regex, it is mentioned to take "_" and not "-" 

How do I fix it?

[ITWhisperer]

It is not clear what you are expecting to get from STP_Stores_DiskSpace_stp-44slcapp9_20230809

[man03359]

I am extracting all the other fields, "device", "key", geo", "incident_group" from the correlation_id using this regex-

| rex field=correlation_id "^(?P<key>(?P<geo>(\w+[\._])?Stores)[\._](?P<incident_group>[^\._]+)([\._][^\._]+)?[\._](?P<device>[a-zA-Z]{3,4}[a-zA-Z\d]*))([\._])?"

But unfortunately, this regex does not work for some-

e.g. STP_Stores_DiskSpace_stp-44slcapp9_20230809,

it is extracting only : STP_Stores_DiskSpace_stp instead of STP_Stores_DiskSpace_stp-44slcapp9.

I am assuming its because after stp there is "-" and not "_".

I have attached the working one for comparison.

Hope this is clear.

[ITWhisperer]

| rex field=correlation_id "^(?P<key>(?P<geo>(\w+[\._])?Stores)[\._](?P<incident_group>[^\._]+)([\._][^\._]+)?[\._](?P<device>[a-zA-Z]{3,4}[a-zA-Z\d-]*))([\._])?"

[scelikok]

Hi @man03359,

Please try below updated regex;

| rex field=correlation_id "^(?P<key>(?P<geo>(\w+[\._])?Stores)[\._](?P<incident_group>[^\._]+)([\._][^\._]+)?[\._](?P<device>[a-zA-Z]{3,4}[a-zA-Z\d-]*))([\._])?"

[man03359]

I need to extract till STP_Stores_DiskSpace_stp-44slcapp9 under the key field from the correlation id: STP_Stores_DiskSpace_stp-44slcapp9_20230809