How to run a different rex extraction only if another rex extraction did not find anything to extract?

[raby1996]

Hi all,

So I'm currently using this extraction:

| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)" 

However I have found that this is not always present in my data, so I was wondering if there was a way where I could run this (below) rex command only when the first one doesn't find anything?

 "| rex "(?m)(?:\n|.)MS:(?<MS>\s+\S+)"

Thank you.

[somesoni2 · Accepted solution]

Can you provide some sample logs for both patterns?
One dirty workaround would be like this

| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)" | rex "(?m)(?:\n|.)MS:(?<MS1>\s+\S+)" | eval MS=coalesce(MS,MS1)

[raby1996]

That worked great! thank you

[raby1996]

If you would like to convert it as an answer I'll accept it for you

[somesoni2]

Here you go.