Field extraction stanza help in props.conf?

[pavanae]

I have the username filed extraction as follows in the props.conf which extracts the username:-

[sourcetype_X]
EXTRACT-XYZ = username="(?<user>[^+\"]*)"

which extracts the field as follows

x12345@abc-def-ghij-01.com
y67891@klm-def-ghij-01.com
z45787@abc-def-ghij-01.com
ABC-DEF

Now what would be regex stanza to extract the username as follows from the above

x12345
y67891
z45787
ABC-DEF

[martin_mueller · Accepted solution]

Three things to do:

• include the @ sign in your negated character class
• remove the tailing double quote
• replace the * with a + to avoid empty usernames

[pavanae]

Thanks @martin_mueller could you provide me the new regex as mentioned above. I might have missing something.

[jethrop]

^(.+?)@ ie everything before the @ sign if that's a pattern