How to write a regular expression to filter out field values starting with "note-", followed by more than 15 characters?

[kiran331]

Hi

I want to exclude the field values starting with "note-" and more than 15 characters after it. How can I write the regex for this.

eg:

device
note-acv234454dfgdfg
note-dfdffgfghffe4353456

[somesoni2]

You can try like this

your base search | regex yourfield!="^note-\w{15}.*"

[sundareshr · Accepted solution]

Does it have to be in regex? You could extract all the fieldvalues and then filter out using where Like this

... | rex (?<device>captureeverything> | where NOT match(device, "note*") OR len(device)<15