Regex generation

[Deepz2612]

I have the below set of events where I wanted to write regex to capture only the last word

Kindly help

[woodcock]

Like this:

... | rex "(?<LastWord>\w+)$"

[gcusello]

Hi Deepz2612,
I don't see the set of events.
Anyway, to extract the last word od an event and put it in a field, you could use a regex like this:

| rex "\s+(?<my_field>\w+)$"

that you can test at https://regex101.com/r/hofrdl/1 .

Ciao.
Giuseppe

[rmmiller]

Assuming you just want the last word in each event, this should work fine:

.+\b(\w+)$

If you want a more restrictive match, looking for only "begin" or "end", then this should work:

.+\b(begin|end)$

Hope that helps!
rmmiller

Edit: Used https://regexr.com/ to test/generate regex.