Regex: Why am I getting this syntax error in subpattern name (missing terminator)?

[Jewatson17]

I keep getting the missing terminator error when trying to parse. I am not sure whats the problem

Here is my regex:

| rex field=referer "/en-US/app(?<<app>>[^/]+)/(?<<dashboard>&g>;[^?/\s]+)"

[gcusello]

Hi Jewatson17,
could you share an example of the log to parse?
it seems that you want to parse the address of a dashboard,
if this is true probably the problem is a missed slash (/) and something elase, try something like this:

| rex field=referer "/en-US/app/(?<my_app>[^/]+)/(?<my_dashboard>[^?/ ]+)"

Bye.
Giuseppe

[Jewatson17]

I'm trying to pull the usage of ALL the dashboards in my environment.

[493669]

Hi @Jewatson17,
Try this:

| rex field=referer "\/en-US\/app\/(?<app>[^\/]+)\/(?<dashboard>[^?]+)"

[FrankVl]

Escaping the forward slashes is not even necessary I think. Key thing to fix is the redundant characters and the &g and ; in the dashboard field extraction.