I am extracting a list of free text string in the _ raw and creating a new field.
The list of terms comes from user input, on the search input of a dashboard.
I cant seem to find how to place the token/variable in the regex... probably something easy im missing.
$token$="test|google|domain|badguy" (formmated this way so regex can see it as OR separated list)
rex field=_raw " (?<extractedfieldname>$token$) (does not work)
Is there a way to do this?
if not a token option, can i:
eval tokenname=$token$
rex field=_raw " (?<extractedfieldname>'tokenname') (does not work)
After the token/variable is placed correctly this is the search format im looking for:
rex field=_raw " (?<extractedfieldname>test|google|domain|badguy) (this does work)
thanks for any help!
You could try something like this
| makeresults
| eval _raw="test|google|domain|badguy|something else"
| eval event=split(_raw,"|")
| mvexpand event
| eval _raw="random text ".event." other random text"
| fields - event _time
| eval search="test|google|domain|badguy"
| eval extractedfieldname=replace(_raw,"(?:.*)(?<t>".search.")(?:.*)","\1")
| eval extractedfieldname=if(extractedfieldname=_raw,null(),extractedfieldname)
The first part (before the blank lines) sets up some sample dummy events.
The second part sets a field to be the regex you want (could be from a token), then uses replace to extract the matching string from _raw. If there is no match, the matched string is equal to _raw so this just needs to be replaced with null in this instance.
| rex max_match=0 field=_raw "(?<extractedfieldname>(17|7|1))"
this will work but will still need the variable to be passed to this rex
with the replace is it only gonna show me one hit from the passed list or does it need to be appended in some way?
Yes you are going to get one hit (which is what your examples were doing); in this case it will be the last one. If you want the first one add a ? to the first unnamed group
| eval extractedfieldname=replace(_raw,"(?:.*?)(?<t>".search.")(?:.*)","\1")