rex field

[Yim]

Hi everyone, 

I am using rex field to extract content that containst the following word: full

| rex field=msg_old "(?<msg_keyword>full).*"

However, what I actually need is to extract content with the word full alone, not words that contain full in between, just the word full itself. 

Can you please advise if the sentence needs to be different? Thanks

[isoutamo]

Hi

a nice place to test regex is regex101.com.

https://regex101.com/r/5maP5V/1 here is one example how this can achieve.

| rex field=msg_old "\b(?<msg_keyword>full)\b"

If you want select only events which have word full in field msg_old then you should try

| regex msg_old = "\bfull\b"

 r. Ismo

[ITWhisperer]

It is not clear what you are trying to do. You use "full" in your pattern, but you mention "FULL" in your description. Do you need what is extracted to be changed to uppercase? What do you mean by "not between"? Do you just want the word "full" if it exists in the msg_old field? Please clarify with sample (anonymised) events and a clear description of what you want to extract from where, and under what circumstances. Please also include a representation of what your expected output would look like.

[Yim]

Hi ITWhisperer,

For example, with that instruction I am extracting data from msg_old field with the word full in between like: she works successfully for us, but what I need is just data that contain the word word "full" itself. 

For instance: The house is full. 

Hope this can clarify. Thanks.

[ITWhisperer]

Not really. Please provide a sample anonymised event in raw format, in a code block (using the </> button above) to preserve the format of the event. Please indicate which part of the event you want extracted.

[Bhumi]

Hi @Yim 

Are you trying to extract it from the field or raw data ? 

Please send me the sample data and elaborate it what you are trying to achieve as an output. 

[Yim]

Hi Bhumi,

For example, with that instruction I am extracting data from msg_old field with the word full in between like: she works successfully for us, but what I need is just data that contain the word word "full" itself. 

For instance: The house is full. 

Hope this can clarify. Thanks.