Need help with regex in transforms.conf to find two words in an event

[gerdhuber]

Hallo,
i have to filter the following literals in an event and i am new in regex:

user:info
ifconfig

both literals must be in that event.

this don't works:
^.?\buser:info\b.?\bifconfig\b.*?$

Thank you for helping
Gerd

[woodcock]

Like this:

(?ms)(?:user:info.*ifconfig)|(?:ifconfig.*user:info)

[DalJeanis · Accepted solution]

If you are coding the initial search, rather than using data that has already been pulled by some prior search, then this search will return only records on the index called "foo" which have both your search terms...

index=foo  "user:info" "ifconfig"

For an initial search, that is the most efficient way.

---

On the other hand, if you are trying to reduce a prior selection to only records which have both those fields, you could use either of these...

| search  "user:info" AND "ifconfig"

or

| regex field=_raw "^.*?user:info.*?ifconfig.*$"

---

This regex will match events that have the two terms in that order...

^.*?user:info.*?ifconfig.*$

There are additional things you could do to make the regex marginally more efficient when it FAILS to match the event, but that's all you really need.

Note: in some contexts the : may need to be escaped, so the regex would look like this...

^.*?user\:info.*?ifconfig.*$

[gerdhuber]

Thank you

[DalJeanis]

When you post code, be sure to highlight the code and press the "code" button - it looks like 101 010. That will keep the interface from treating the characters in the code as html or formatting commands.

[adonio]

would be helpful if you can share full event.
also try and use regexr or regex101