Help with regex

[bosseres]

Hello everyone,

I need help with regex

I have search

index=*
| regex Commandline="my_regular_expression"

How can I add one more regular expression with OR condition?

something like this | regex Commandline="my_regular_expression" OR | regex Commandline="my_regular_expression2"

Tahnk you

[bosseres]

Thank you very much for responding, and what if I have such condition?

| regex Commandline="my_regular_expression" | (regex Commandline="my_regular_expression2" AND regex Commandline="my_regular_expression3" )

(AND added)

[javiergn]

Hi again,

I couldn’t say. There are many ways to do it. If you can be a bit more specific about your regex I might be able to help more. 

Translating Boolean operators to regex is not trivial and it is not what regex was designed for originally. 

You can replicate an OR the way I told you earlier. You can replicate an AND by simply doing a second regex after the first one but also within the same regular expression assuming the text you want to match follows that order. 

In summary, if you can give us an example of what you are trying to match we could probably help you a lot more. 

[bosseres]

I have 3 regex expressions - regex1, regex2, regex

and I need to find events where field Commandline matches  regex1 or matches regex2 AND regex3

regex1 OR (regex2 AND regex3)

is it possible? thank you

[javiergn]

It will look like the following:

index=YOURINDEXHERE
| regex Commandline="(regex1|regex2.*regex3)"

But I could be wrong as I still don't know what sort of regex you want to write or what kind of string you want to match. Hope it helps anyway.

[javiergn]

Hi @bosseres ,

You could try with the following:

index=*
| regex Commandline="(keyword1|keyword2)"

But if you can tell us exactly what sort of regex you want to implement we might be able to assist a bit more.

Regards,

Javier

[aasabatini]

Hi @bosseres 

the OR condition on regular expression is the pipe "|",

I show you an example

rex filed=_raw "\w+\s+(?<name_field>\w+|\w+\d+)"