Can you help me with my regex pattern match?

[zacksoft]

Here is my code . I want my field record_type to contain only the events/records that contain either of the keywords

****(index=jar1 sourcetype=toss1  shop AND fruits) OR
   (index=jar2 sourcetype=toss2 shop AND meat) OR
   (index=jar3 sourcetype=toss3 shop AND "green vegetables") 
 | rex "(?<record_type>|fruits|meat|green vegetables)"
 | fields record_type  **<==== It only shows me records of "green vegetables" type****
| eval shopping_time=case(record_type="fruits", _time)  bla bla bla <=== gives me no result because record_type only grabs green vegateble words containing records/events.**

Any suggestion?

I suspect the rex statement needs modification !

[sdchakraborty · Accepted solution]

Can you remove the pipe before fruits and try? also use max_match=0 to get all the occurrences.

****(index=jar1 sourcetype=toss1  shop AND fruits) OR
    (index=jar2 sourcetype=toss2 shop AND meat) OR
    (index=jar3 sourcetype=toss3 shop AND "green vegetables") 
  | rex max_match=0 "(?<record_type>fruits|meat|green vegetables)"
  | fields record_type  **<==== It only shows me records of "green vegetables" type****
 | eval shopping_time=case(record_type="fruits", _time)  bla bla bla <=== gives me no result because record_type only grabs green vegateble words containing records/events.**

Sid

[zacksoft]

Thanks. It helps.

[sdchakraborty]

Cool. Then I will change this as answer. Please accept it.

Sid