Regex field extraction

[nmsaraujo]

Hello all,

I have one sourcetype that does not allow me to create a static field extraction, because we have several fields with different name and is almost impossible to cover all of them.

My data is similar to this:

fieldname1 : values1 with spaces - fieldname2 : value2 - fieldname3 : value-for-field3
field name4 : values4withoutspaces - fieldname5 : value5 (this should be included in value5) - fieldname6 : value-for-field3 fieldname7 :

All kv pairs are delimitd by " - " and the pair delimiter  is " : " .

To cover this requirement, I have a field transforms that uses a regex to calculate key-value pairs automatically

[wildcard_extractions]
CLEAN_KEYS = 0
FORMAT = $1::$2
REGEX = (\S+)\s:\s(\S+)

PROBLEM: When the field name or the value has spaces,  I can not get the full values.

Could some, more experienced than me, help me with my regex expression, please?

https://regex101.com/r/R9XhmD/1

[ITWhisperer]

Try something like this

(?<fieldname>[\S]+) : (?<fieldvalue>[^:]+)(?<!\s)?(\s-|$)

[nmsaraujo]

Thanks @ITWhisperer  for the swift reply.

With your suggested regex I still have issues with fields and values that includes spaces, right?

Thanks

[ITWhisperer · Accepted solution]

This might work better if you have spaces in fieldnames

(?<fieldname>.+?)\s:\s(?<fieldvalue>.+?)(?<!\s)?(\s-|$)

[nmsaraujo]

Thanks @ITWhisperer 

Great work!!!!!