I want to omptimize the regex? ErrorMessage : 'rex' command: has exceeded configured match_limit, consider raising the value in limits.conf.

[vn_g]

| rex field=_raw max_match=0 "BodyOftheMail_Script\s=\s\[\sBEGIN\s{0,}(?<BodyOftheMail>.((.|\n)*?)(?=\s{1,}END\s\]))"

I am trying to read body of the mail from logs ( some of the them are more than 500 lines).

I donot want to increase the value in limits.conf . Is my rex correct? Kindly help.

BodyOftheMail_Script = [ BEGIN 500 lines END ]

[harshpatel]

Hi @vn_g,

I would suggest to try and play around with the regex at regex101.com. For the sake of example - https://regex101.com/r/7Rp8b8/1/.

You would see steps count which you can try to minimize as much as possible. I believe Splunk uses a similar metric and sets a hard limit on that for better search performance.

Thanks,
Harsh

[richgalloway]

The rex command requires named capture groups. Please edit the question to correct the regex.