REX command: something or something or nothing

[willial]

Here's my rex:

rex max_match=0 "(MSM-\w+\s+(?<slotMSM>\w+)\s+|MM-\w+\s+(?<slotMM>\w+)\s+|Slot-\d+\s+(?<slotNum>\d+)\s+|)OtherStuffAndsoOn"

This is at the front of a longer bit of rex, so basically a line could start with MSM-A or MM-A or Slot-1, or it could just start at the "OtherStuffAndSoOn" part where there's additional rex that's working fine. I'm trying to accomplish this by ending the first set of OR statements with |), indicating that I'd like it to consider "or none of these."

The problem is that it will pick up lines that start with MSM or MM or Slot, but won't pick up the ones that don't. The |) bit appears to do nothing.

I need to keep it max_match=0 as one log could contain any number of lines (in any of the above configurations) that need to be extracted.

[Ayn · Accepted solution]

You can probably achieve what you want by putting a '?' or '*' after your whole regex. Both these will make the preceding match optional.

http://www.regular-expressions.info/optional.html

[willial]

I discovered that the problem was actually in an eval/mvzip later in the search coming up blank due to the above rex being empty, and requiring an if isnotnull to suss out whether or not it should be zipped, followed by the zip extraction requiring an OR to cover the possibility of there being nothing to extract there.

Either way, this answer works. Also, the (blah\blah\blah|) construction appears to work fine. Everything works, just not my brain. Thanks!

[somesoni2]

like this
rex max_match=0 "(MSM-\w+\s+(?\w+)\s+|MM-\w+\s+(?\w+)\s+|Slot-\d+\s+(?\d+)\s+)*OtherStuffAndsoOn"