How do you write a regular expression to extract a field between two colons with a particular pattern?

[kcchu01]

Hi,

Can anyone teach me how to write a regular expression to extract the field on the following raw event?

sendmail[11111]: w9234FKJa23233: to=xxxxxx

I would like to extract the "w9234FKJa23233" and create a new field that starts with "w" and then 13 char/digits.

Thanks a lot

[harsmarvania57 · Accepted solution]

Hi @kcchu01,

Please try below regex, this will extract everything between : and :

<yourBaseSearch> | rex field=_raw "(?:\s(?<extracted_field>[^\:]+)[\:])" 

If you want results which only starts with w then try below regex

<yourBaseSearch> | rex field=_raw "(?:\s(?<extracted_field>w[^\:]+)[\:])" 

[lakromani]

Your regex is not 100% correct. It matches any text from a space up to :
It will also give data from this line with only one :

sendmail[11111] w9234FKJa23233: to=xxxxxx

So a more correct regex would be:

(?::\s(?<extracted_field>[^\:]+)[\:])

It will extract all data between two :, except the first space.

Also you do not need to escape the : or put it in brackets at the end, so:

(?::\s(?<extracted_field>[^:]+):)

[kcchu01]

Thanks a lot, the field is extracted perfectly.