Getting data out of an event with a regular expression

[MattPainting]

I am trying to figure out how to get data out of the event and into a field. I need to get all the data in brackets.

Sample data:

Run,jump,fly[walk]dog/cat

File storage ,[app - run] development

I want the result put into a new field and look like this:

walk

app - run

[gcusello]

Hi @MattPainting,

if you want to extarct a field from a log, I hint to use the guided self extractor.

Anyway, using a regex, you can extract the value between square parenthesis putting it into a field:

| rex "\[(?<my_field>[^\]]+)"

Ciao.

Giuseppe

[ITWhisperer]

| rex "\[(?<result>[^\]]+)"

use max_match=0 if there is more than one bracketed result in an event