How do you extract fields that end with a question?

[Deepz2612]

I wanted to extract a field to capture the data before the question mark as below.

api_call "Get \search\ip\6789\?=number\90"

where api_call is an already extracted field.

I wrote it as a rex field = api_call "/"(?[^/?])" ---- result required is Get \search\ip\6789\
but it doesn't seem to work.

[wrangler2x]

This works:

| makeresults
| eval foo= "Get \search\ip\6789\?=number\90"
| rex field=foo "(?<api_call>[^\?]+)\?"
| table api_call foo

api_call                foo
Get \search\ip\6789\    Get \search\ip\6789\?=number\90

[vnravikumar]

Hi @Deepz2612

Please try

| makeresults 
| eval api_call= "Get \search\ip\6789\?=number\90" 
| rex field=api_call "(?P<result>.*)\?="

[FrankVl]

Using .* should be avoided where possible (as it triggers excessive matching and backtracking) and in this case there is no need for it. (in this tiny example, it causes 30 steps to complete according to regex101, compared to 9 for my solution).

[markusspitzli]

Hi @Deepz2612

I have tried this regex for extracting the field messsage. (it worked with regex101.com)
\"(?<message>\w+\s\S+)\?`

wit rex it should look like this:
rex field=api_call "\"(?<message>\w+\s\S+)\?"

[FrankVl]

Using \S+ is not very efficient (as it includes the ? and will require backtracking to get the actual match). And in this case there is no need for it. (in this tiny example, it causes 32 steps to complete according to regex101, compared to 9 for my solution).

[FrankVl]

When you want to escape special characters like quotes and questionmarks, you need to do that using a \ not a /. Anyway no need to escape that questionmark in that location in the regex. You also need to add a + to make it match multple non-? characters.

Try this: rex field = api_call "\"(?<field1>[^?]+)"

https://regex101.com/r/zaolbY/1