Hi Martin, Thanks for offering your help. By researching and playing with http://www.regexr.com/ I have found my answer and by working more with Regexr tool I have found answers to a lot more questions.
This is my solution:
index="main" interaction.type=twitter | regex interaction.content="((word1)\W+(?:\w+\W+){1,8}?(word2)W)"
The following regex may be more than you need, but has a few extra facets:
Uses word boundary anchors for matches at the beginning or end of the field.
index="main" interaction.type=twitter | regex interaction.content="(?:\bword1\b\W(?:\w+\W+){0,6}?\bword2\b|\bword2\b\W(?:\w+\W+){0,6}?\bword1\b)"
Hope it's useful.
Barry
Hi Martin, Thanks for offering your help. By researching and playing with http://www.regexr.com/ I have found my answer and by working more with Regexr tool I have found answers to a lot more questions.
This is my solution:
index="main" interaction.type=twitter | regex interaction.content="((word1)\W+(?:\w+\W+){1,8}?(word2)W)"
Correction - for some reason the backslash did't show above:
index="barclays" interaction.type=twitter | regex interaction.content="((word1)\W+(?:\w+\W+){1,8}?(word2)\W)"
How is "word" defined in your context?
Got Sample data?
What's not working in your own solution?