Given data like this:
v1=1 v2=2 v3=3.45 v4=4 key=bad
v1=6 v2=7 v3=8.45 key=good v4=9
I want to mask the vX values in the case of key=bad only. I cannot guarantee order. Results should be:
v1=x.xx v2=x.xx v3=x.xx v4=x.xx key=bad
v1=6 v2=7 v3=8.45 key=good v4=9
Is this possible?
Hi twinspop,
Try to follow this example using your sample data.
01/19/2016 11:34 v1=1 v2=2 v3=3.45 v4=4 key=bad
01/19/2016 11:22 v1=6 v2=7 v3=8.45 key=good v4=9
With the given SEDCMD regex below, using Positives Lookbehind/Lookahead.
[your_sourcetype]
SEDCMD = s/(?<=v1=).*(?=\sv2=.*?\skey=bad)/X.XX/g s/(?<=v2=).*(?=\sv3=.*?\sv4=.*?\skey=bad)/X.XX/g s/(?<=v3=).*(?=\sv4=.*?\skey=bad)/X.XX/g s/(?<=v4=)\d(?=\skey=bad)/X.XX/g
Hope it helps.
This might lead to the correct way, but the field names (aside from key) are variable. I should have included that tidbit. 🙂 Reading up on PLBs and PLAs. Thanks!
I'm not able to make this work because the fields that need masking occur an arbitrary number of times. Roughly speaking what I need is:
if (/key=bad/)
s/v(\d+)=\d+\.\d{2}/v\1=x.xx/g
(this will teach me to use better sample data -- sorry)
It's okey mate, dont worry about it.
Check this out, based on your sample data again, this regex should match (n) amount of fields.
s/(?<==)(\d+\.\d{1,}+|\d+)(?=.*?key=bad)/X.XX/g
EDIT: regex101 example, https://regex101.com/r/uM9nW8/1