Two multivalue fields needed

[wkassel]

Hi - I need to extract two multivalue fields from each event. Let's say the strings are "AAA-" and "BBB-". Each string is followed by a number after the hyphen. An event will have one or both of these strings and possibly multiples of each, hence multivalue. I can pipe the search to a rex command (e.g. |rex max_match=0 "(?AAA-[0-9]+)") which gets me the multivalues of AAA- for each event but how can I include BBB- if it exists in the event as well, or vice versa ?

Thanks,
W

[richgalloway · Accepted solution]

If you want use rex to match either of two strings, use a '|'. This string should match either "AAA-1" or "BBB-1".

| rex max_match=0  "(?<foo>(?:AAA|BBB)-[0-9]+)"

You can use regex101.com to test possible regex strings against sample data.

[wkassel]

Brilliant! I was trying to get two multivalue fields extracted but no reason they can't be in one field in this case. Great idea! Thank you.

[richgalloway]

If your problem is solved, please accept the answer to help future readers.