How to write a regex for string followed by number?

[arjun_krishna]

Below are my 3 logs, i want to write a query, to get all the below 3 logs:

**EXT_CODE*[0-9]** with 1/2/3 digit followed by EXT_CODE

index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

Can some one please suggest the query

my query: index="zync*" EXT_CODE[0-9]*="*" 

[mhoogcarspel_sp · Accepted solution]

provided that that is the _raw, if you just need to find the events you can use the regex command:

| makeresults

| eval _raw="EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010"
| regex "(EXT|GEN)_CODE\d{1,3}="

[arjun_krishna]

regex "EXT_CODE\d{1,3}="
This is working for me , but i want both EXT_CODE & GEN_CODE followed by 1/2/3 digit followed (Eg: GEN_CODE017 (or) GEN_CODE001 (or) GEN_CODE999 (or) EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)

[tomawest]

Does this work? regex "(EXT_CODE\d{1,3}=|GEN_CODE\d{1,3}=)

[arjun_krishna]

@mhoogcarspel , Please respond

[mhoogcarspel_sp]

Missed that part

(EXT|GEN)_CODE\d{1,3}=

should work for that

btw, I use regex101 for a lot of these things:
https://regex101.com/r/RfKqEt/2
really great tool

[arjun_krishna]

Great its working for me

[493669]

can you please share some sample logs and what you need to extract..

[arjun_krishna]

log1: index="zync*"|EXT_CODE2=AB003|EXT_CODE35=BC003|EXT_CODE4=CA010|GEN_CODE14=CD010
log2: index="zync*"CDT|EXT_CODE4=XY005|EXT_CODE42=DE040|EXT_CODE4=ZQ019|GEN_CODE11=PY016
log3: index="zync*"|EXT_CODE5=PC099|EXT_CODE22=BC054|EXT_CODE4=ZC018|GEN_CODE11=ZV010

from multiple logs, i have to get above logs which are having EXT_CODE followed by 1/2/3 digit followed (Eg: EXT_CODE017 (or) EXT_CODE001 (or) EXT_CODE999 (or) ......)