Regex help

[JPaule]

Could someone help me on this regex? I only want the first part of the data up to "AWSLogs". Example Below:

s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz

I only need:
s3://this-is-bucket-name/test/AWSLogs

[koshyk · Accepted solution]

Please find sample

|makeresults
|eval myraw="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz"
| rex field=myraw "(?<aws_regex>s3:\/\/.+?\/.+?\/.+?\/)"
| table myraw,aws_regex

demo in regex101 => https://regex101.com/r/KkQkfR/1

[MuS]

Hi JPaule,

give this a try:

| makeresults 
| eval foo="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz" 
| rex field=foo "(?<s3BucketName>^s3:\/\/[^\/]+\/[^\/]+\/AWSLogs\/)"

Hope this helps ...

cheers, MuS