Extraction using regular expressions

[honobe]

I want to extract a character string using a regular expression.

I am considering extracting the field (message ID) using the rex command, but I can not extract it with regular expressions.

Message ID = '<　xxxxxxxx>'

※I want to extract characters between ｢'<｣ and　｢>'｣
※There is no space in the actual log.

I want to extract xxxxxxxx and make the field of message ID have the following form.

Message ID = xxxxxxxx

What kind of regular expression can I use to extract xxxxxxxx?

[MuS]

Hi honobe,

based on the provided information this regex:

 '<(?<Message_ID>[^>]+)>'

will match everything between '< and >' and use the match in the new field called Message_ID.

This is a really basic example and can be optimised but I hope it helps to get you started ...

btw don't use field names with spaces 😉

cheers, MuS

[honobe]

Thank you very much.
Thanks to your answer, I was able to solve the problem.

[niketn · Accepted solution]

Try the following run-anywhere example.

| makeresults 
| eval _raw = "Message ID = '<　xxxxxxxx>'"
| rex field=_raw "Message ID = '<(?<MessageID>[^>]+)>'"

You can test the rex with your sample events. Eventually, create a Field Extraction Knowledge Object for the same.

[honobe]

Thank you very much.
Thanks to your answer, I was able to solve the problem.

[MuS]

typing too slow...again

Just a little tip: there is actually no need to escape the > inside of the [...] it will also work without the escaping

[niketn]

Thanks @Mus, I have corrected. But \ in regular expression also tells match exactly. It works either way, I missed removing it.