Can anyone provide me a simple example for using REGEX with DELIMS?

[zcwang]

Could anyone provide me a simple example for using REGEX with DELIMS? The event in my scenario is full of delimiter-separated field/value pairs, so I used two sets of quoted delimiters. However, the first set of delimiters might be either "," or " ". So I wonder if I could use an OR for the first delimiter. Thanks!

[Richfez]

zcwang,

An example of the item in question would make this easier, but I'll try:

Any of the delimiter characters you specify will be considered a delimiter. The docs for transforms.conf provides an example of this

[multiple_delims]
DELIMS = "|;", "=:"

Which they describe as The above example extracts key-value pairs which are separated by '|' or ';', while the key is delimited from value by '=' or ':'.

So that would use either | or ; for the field separators and either one of = or : as the field=value separator. This would match log lines like

|field1=val1;field2=val2|field3:val3;field4=val4;

and pull out of them

field1=val1
field2=val2
field3=val3
field4=val4

[MuS]

providing some sample events will be useful in this case.....