How to match start of field string using regex?

[mhulse]

Hello,

I am trying to match the start of a path in httpRequest.uri, as seen here:

index=xyz source=xyz 
| spath "httpRequest.headers{}.value"
| search "httpRequest.headers{}.value"="application/json"
| spath "httpRequest.uri"
| regex "^/public*"
| stats count by "httpRequest.uri"
| sort -count 

Unfortunately, it isn't working.

Can someone point out what I am doing wrong here?

If I get rid of the caret, the regex works, but it matches anywhere within the field’s string value. I need to start from the beginning of the string.

Thank you so much in advance!

[scelikok · Accepted solution]

Hi @mhulse,

regex command works on _raw as a default. You need to tell the field like below;

index=xyz source=xyz 
| spath "httpRequest.headers{}.value"
| search "httpRequest.headers{}.value"="application/json"
| spath "httpRequest.uri"
| regex "httpRequest.uri"="^/public.*"
| stats count by "httpRequest.uri"
| sort -count 

[mhulse]

Thank you so much @scelikok!!! I greatly appreciate your help! 🙂