Field regex behaves differently for "Field extractions" and for rex

[frink]

I've got some log data that has a multi-line event this format:

2011-04-28 11:40:00|ACTION|1304005199906869|stuff|stuff|stuff

SPARAM|1304005199906869|PartNumber|1613034

SPARAM|1304005199906869|OtherParameter|8528

SPARAM|1304005199906869|OtherParameter2|true

I've created a regex to pull out the PartNumber field, and it seems to work perfectly when I run it through rex:

... | rex field=_raw "(?m)^SPARAM\|\d*\|PartNumber\|(?<SearchPartNumber>.*)"

Result: "1613034"

When I take the same regex and make it a saved Field extraction, I get the value I want plus everything else to the end of the event.

Result: "1613034

SPARAM|1304005199906869|OtherParameter|8528

SPARAM|1304005199906869|OtherParameter2|true"

I've tried adding an optional newline or end of line character to the end of the regex and it doesn't help.

Any thoughts on why this would behave differently and what I can do to fix it?

Thanks.

[gkanapathy · Accepted solution]

The (?s) option defaults differently.

Use (?m-s)^SPARAM at the beginning, or else (?<SearchPartNumber>\V*) to prevent . from matching across line breaks.

[frink]

Thanks so much for the prompt response. That fixed it!